Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-77006: WebTotem Backups plugin lets any logged‑in user delete any file
CVE-2026-77006 · published 1 month ago
Summary
The WebTotem Backups add‑on for WordPress does not verify the file path you give it, nor does it check whether the user has permission to perform the action. As a result, even a low‑level account such as a subscriber can remove any file on the server, potentially giving an attacker full control of the site. Update the plugin to version 1.1.0 or later, or remove it if an update is not available, and restrict access to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | webtotem backups | <= 1.0.1 |
Original advisory text
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF...
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
9.6
Critical
Type
CWE-73External Control of File Name or Path
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published12 Sep 2026
Updated7 Oct 2026
First seen12 Sep 2026
Track software like this
Free during beta