CVE-2026-77006: WebTotem Backups <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal
The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The issue does not require administrative privileges.
What does an attacker need to do to exploit it?
The attacker needs a valid authenticated account and must submit a user-controlled file path to the affected plugin functionality. The path is not validated, enabling path traversal to target arbitrary server files.
Are sites affected when using default WordPress roles?
Yes. A site is exposed if untrusted users can register or otherwise obtain even Subscriber-level authenticated accounts while the plugin version is 1.0.1 or earlier is installed.
What is the impact of successful exploitation?
An attacker can delete arbitrary files on the server. This can disrupt the site and may lead to site takeover.