← CVE Intelligence

CVE-2026-77006

WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal PUBLISHED

Description (CNA)

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

Affected (CNA)

Vendor / productVersions
Unknown / WebTotem Backupsaffected 0 before 1.1.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.