Pay with a Tweet WordPress Plugin Arbitrary File Deletion Vulnerability

The Pay with a tweet WordPress plugin through version 1.0.5 contains an arbitrary file deletion vulnerability.

The plugin does not validate a file path before deleting it, and it does not restrict access to the relevant administration screens.

• Users with a role as low as Subscriber can delete arbitrary files on the server.
• This can lead to a full site compromise.