CVE-2026-77006

The WebTotem Backups WordPress plugin through version 1.0.1 contains a chained flaw in its file-deletion function: it does not validate the user-supplied file path, does not verify the requesting user's capabilities, and discards the result of its own CSRF check. As a result, any authenticated user — even a low-privilege role such as subscriber — can submit the plugin's request with a crafted path and delete arbitrary files on the web server. Arbitrary file deletion on WordPress can enable full site takeover, for example by deleting wp-config.php to force the site back into its installation routine and reclaim it. All sites running the plugin through version 1.0.1 are affected. No public proof of concept is known and the flaw is not on the CISA KEV list, so there is no indication of active exploitation.

What to do: Update the plugin if a release newer than 1.0.1 is available; if no fixed version exists, deactivate and delete WebTotem Backups and switch to an alternative backup solution. Audit file systems and logs for unexplained deletions — particularly wp-config.php, .htaccess, and index.php — and check whether the site was forced into a reinstall or otherwise tampered with. Additionally, review subscriber and other low-privilege accounts for unauthorized registrations, and consider a WAF rule blocking the plugin's file-deletion endpoint.