WordPress Plugin Vulnerabilities

WebTotem Backups <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

Description

The plugin does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

Proof of Concept

Affects Plugins

Plugin icon
wt-backups
No known fix

References

CVE
CVE-2026-77006

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
9.6 (critical)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
71bc08cb-681c-44bd-b6a0-bb5c58e31653

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2026-06-16
Title
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
Published
2020-10-29
Title
WordPress < 5.5.2 - Protected Meta That Could Lead to Arbitrary File Deletion
Published
2026-06-27
Title
Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2026-05-26
Title
Xpro Elementor Addons - Pro < 1.4.8 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG
Published
2025-04-07
Title
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download