critical9.6
CVE-2026-77006
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, a…
Impact
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
Affected products
| Product | Affected versions |
|---|---|
| WebTotem Backups WordPress Plugin | before 1.1.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.