CVE-2026-78530: WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability
Published Oct 10, 2026
·Updated
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
Affected Software
1 affected component
WordPress FoodBakery theme<=4.6
Event History
Oct 10, 2026
CVE Published
via MITRE·07:36 PM
Data Sourced
via MITRE·07:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs a low-privileged authenticated account, such as a Subscriber account. The attack can be performed remotely and does not require user interaction.
2
What is the expected impact?
The vulnerability allows arbitrary file deletion through path traversal. The listed impact is primarily on availability, with high availability impact and no listed confidentiality or integrity impact.
3
Which deployments should be prioritized for remediation?
WordPress sites using FoodBakery theme version 4.6 or earlier should be prioritized, especially where Subscriber registration or other low-privileged account access is available.