CVE-2026-15802: WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15802?
CVE-2026-15802 has a severity rating of 8.1, classified as high.
How do I fix CVE-2026-15802?
To fix CVE-2026-15802, update the WP Foodbakery plugin to a version beyond 4.9 that addresses this vulnerability.
Who is affected by CVE-2026-15802?
Authenticated users with subscriber-level access to the WP Foodbakery plugin are vulnerable to CVE-2026-15802.
What type of vulnerability is CVE-2026-15802?
CVE-2026-15802 is an arbitrary file deletion vulnerability caused by insufficient file path validation.
What impact does CVE-2026-15802 have on my website?
CVE-2026-15802 allows attackers to delete files on the server, potentially compromising website functionality and data integrity.