Arbitrary File Deletion Vulnerability in WP Foodbakery Plugin by WordPress

CVE-2026-15802

What is CVE-2026-15802?

The WP Foodbakery plugin for WordPress is susceptible to arbitrary file deletion due to a flaw in file path validation within the 'delete_locations_backup_file_callback' function. This vulnerability affects all versions up to and including 4.9, allowing authenticated users with subscriber-level access and higher to delete files from the server. If critical files, like wp-config.php, are removed, it could lead to remote code execution, severely compromising the server's security.

References