{"id":"CVE-2026-40805","published":"2026-10-10T20:16:34.353","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/peepso/vulnerability/wordpress-peepso-plugin-9-0-5-4-arbitrary-file-deletion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows authenticated subscribers to delete arbitrary files on the server by manipulating file paths in PeepSo plugin versions up to 9.0.5.4, potentially leading to service disruption or data loss.","exploitability":"Exploitation requires an authenticated subscriber account with access to the PeepSo plugin, and is relatively straightforward once the attacker has credentials.","blast_radius":"If exploited, this vulnerability could lead to deletion of critical application files, user uploads, or configuration data, causing service degradation or complete system unavailability.","remediation":"Upgrade to PeepSo version 9.0.5.5 or later to remediate this arbitrary file deletion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["file-deletion","arbitrary-file","plugin","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:11.505Z"}}