WordPress Plugin Vulnerabilities

Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

Description

The plugin does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

Proof of Concept

Affects Plugins

Plugin icon
code-monkeys-proposals
No known fix

References

CVE
CVE-2026-77005

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
9.6 (critical)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
b9340774-84c2-41ec-a770-0123dd5608c2

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2026-06-27
Title
Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2024-12-20
Title
Easy Digital Downloads < 3.3.3 - Authenticated (Admin+) Arbitrary File Download
Published
2020-10-07
Title
HyperComments <= 1.2.2 - Unauthenticated Arbitrary File Deletion
Published
2026-07-16
Title
Kirki < 6.0.14 - Editor+ Path Traversal to Arbitrary Directory Deletion via family
Published
2022-11-30
Title
Easy WP SMTP < 1.5.2 - Admin+ Arbitrary File Deletion