File Deletion Vulnerability in WebTotem Backups Plugin for WordPress
CVE-2026-77006

Currently unrated

Key Information:

Vendor

WordPress
Status
Webtotem Backups
Vendor
CVE Published:
12 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-77006?

The WebTotem Backups plugin for WordPress prior to version 1.0.1 contains a vulnerability where it fails to validate user-supplied file paths and does not adequately check the permissions of users making requests. This oversight allows authenticated users, even those with the lowest privileges (like subscribers), to delete arbitrary files on the server. The lack of proper CSRF checks further compounds the risk, potentially leading to unauthorized site alterations or complete takeover by malicious users.

Affected Version(s)

WebTotem Backups 0 <= 1.0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-77006 - Proof of Concept

References

https://wpscan.com/vulnerability/71bc08cb-681c-44bd-b6a0-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Ramos Maciel
WPScan
.