WordPress WebTotem Backups plugin <= 1.0.1 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by João Ramos Maciel in WordPress Plugin WebTotem Backups versions = 1.0.1...

CVE-2026-77006

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77006 WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77006 WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

EUVD-2026-76814

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77006

The WebTotem Backups WordPress plugin, affecting versions before 1.1.0 (specifically through 1.0.1), contains a vulnerability allowing for arbitrary file deletion . The root cause is a failure to validate user-supplied file paths, a lack of user capability checks, and the discarding of internal C...

PT-2026-90558

Name of the Vulnerable Software and Affected Versions WebTotem Backups versions prior to 1.0.2 Description The plugin fails to validate user-supplied file paths, does not verify the capabilities of the user making the request, and ignores the results of its own Cross-Site Request Forgery CSRF...

CVE-2026-77006: External Control of File Name or Path

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...