CVE-2026-77006 — WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the re…
Published: 2026-09-12 · CVSS: 9.6 · CVSS 3.1
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7