CVE-2026-77005
This critical vulnerability (CVE-2026-77005) affects the CODE MONKEYS WordPress plugin (version 1.0.1 and earlier) because it fails to validate user-supplied file paths before deletion and does not properly verify user permissions. Any authenticated user—including low-privilege accounts like subscribers—can exploit this flaw to delete arbitrary files on the server, potentially resulting in full site compromise.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
CODE MONKEYS WordPress plugin (v1.0.1 and earlier)
Real-world impact
An attacker could destroy critical site files, leading to loss of control over the website and potential further exploitation.
Why this severity
The CVSS score of 9.6 (Critical) indicates this is a high-severity issue that can be exploited without user interaction and may allow complete system takeover.
What to do about it
- ›Upgrade the CODE MONKEYS WordPress plugin to a newer version that addresses this issue (if a fix becomes available).
- ›Restrict file deletion operations to authorized users only via proper access controls.
- ›Implement strict path validation and authorization checks on the server side.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix is documented in the provided sources. The vulnerability details come from the NVD entry for CVE-2026-77005, which describes the missing file path validation and insufficient permission checks in the CODE MONKEYS plugin.