CVE-2026-77006
The WebTotem Backups WordPress plugin (up to version 1.0.1) fails to validate file paths, ignore user permissions, and bypass CSRF checks, allowing any logged‑in user to delete arbitrary files on the server. This flaw can lead to a complete takeover of the site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites running the WebTotem Backups plugin version 1.0.1 or earlier.
Real-world impact
An attacker who is logged in as any user can delete any file on the server, potentially removing core files, plugins, or themes, and thereby compromising or taking over the entire site.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is network reachable, requires low attack complexity, low privileges, and no user interaction, while providing complete loss of confidentiality, integrity, and availability.
What to do about it
- ›Disable or uninstall the WebTotem Backups plugin until a patch is released.
- ›Restrict user roles so that only administrators can access the plugin's delete functionality.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description