CVE-2026-77005

The CODE MONKEYS PROPOSALS WordPress plugin through version 1.0.1 deletes a user-supplied file without validating the path or checking the requesting user's capabilities (CWE-73). This means any authenticated user — even a low-privileged subscriber — can supply a crafted file path, including paths outside the plugin's intended directory, and delete arbitrary files on the server. By removing critical files such as wp-config.php or .htaccess, an attacker can trigger a WordPress reinstallation/reconfiguration flow and ultimately take over the site, reflecting the critical 9.6 CVSS score with high integrity and availability impact. Sites running the plugin at or below 1.0.1, especially those with open registration or many subscriber-level accounts, are the most exposed. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so exploitation is currently assessed as none known.

What to do: Update to a version newer than 1.0.1 if the developer has released a fix; if no patched version exists, deactivate and delete the plugin. Restrict self-registration and review user lists for unexpected subscriber accounts, and verify server integrity by checking for missing or tampered core files (e.g., wp-config.php, index.php, .htaccess), restoring from a clean backup if any are found.