CVE-2026-15802 Overview
CVE-2026-15802 is an arbitrary file deletion vulnerability in the WP Foodbakery plugin for WordPress. The flaw exists in the delete_locations_backup_file_callback function and affects all plugin versions up to and including 4.9. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server due to insufficient file path validation. Deletion of critical files such as wp-config.php can trigger the WordPress setup workflow, enabling remote code execution against the site.
Critical Impact
Subscriber-authenticated attackers can delete wp-config.php and other arbitrary files, escalating to remote code execution on affected WordPress sites.
Affected Products
- WP Foodbakery plugin for WordPress — all versions through 4.9
- WordPress sites bundling the Food Bakery theme distribution
- Any WordPress installation exposing subscriber-level registration with WP Foodbakery active
Discovery Timeline
- 2026-07-22 - CVE-2026-15802 published to the National Vulnerability Database
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-15802
Vulnerability Analysis
The vulnerability sits in the delete_locations_backup_file_callback AJAX handler exposed by the WP Foodbakery plugin. This handler accepts a file path parameter from an authenticated user and passes it to a filesystem delete operation without validating that the target resides within an allowed backup directory. The weakness is classified as [CWE-23] Relative Path Traversal.
Because the callback only enforces authentication and not authorization scope, any account with subscriber capabilities or higher can invoke it. WordPress installations that allow open registration expose the primitive to unauthenticated attackers who first create an account. Deleting wp-config.php forces WordPress into its installation state on the next request, at which point an attacker can reconfigure the site to point at a database they control and execute arbitrary PHP through the setup flow.
Root Cause
The root cause is missing canonicalization and allow-list validation of the user-supplied path in delete_locations_backup_file_callback. The function trusts the supplied filename and constructs a filesystem path that traversal sequences such as ../ can redirect outside the intended backup directory. No capability check beyond basic authentication gates the destructive action.
Attack Vector
The attack vector is network-based over HTTP(S) against the WordPress admin-ajax.php endpoint. An attacker authenticates with a low-privilege account, issues a crafted AJAX request to the vulnerable action, and supplies a traversal path targeting wp-config.php or other critical files. No user interaction is required.
See the Wordfence Vulnerability Report for additional technical detail on the vulnerable callback.
Detection Methods for CVE-2026-15802
Indicators of Compromise
- Missing or truncated wp-config.php file coinciding with a WordPress setup screen being reachable at the site root
- POST requests to /wp-admin/admin-ajax.php with action=delete_locations_backup_file_callback originating from subscriber accounts
- Filesystem audit events showing plugin PHP processes unlinking files outside the WP Foodbakery backup directory
- Newly registered subscriber accounts followed within minutes by AJAX activity targeting the plugin
Detection Strategies
- Alert on any HTTP request invoking the delete_locations_backup_file_callback AJAX action, and correlate the requesting user role
- Monitor web server access logs for admin-ajax.php requests containing traversal sequences such as ..%2F or ../ in POST bodies
- Deploy file integrity monitoring on wp-config.php, .htaccess, and PHP files in the WordPress root directory
Monitoring Recommendations
- Ingest WordPress access and PHP error logs into a centralized analytics platform to correlate deletion events with the invoking user session
- Track spikes in low-privilege account creation on sites running WP Foodbakery
- Baseline expected file operations by the plugin and alert on unlinks outside the allowed backup path
How to Mitigate CVE-2026-15802
Immediate Actions Required
- Update WP Foodbakery to a version above 4.9 once a patched release is available from the vendor
- Disable the plugin on affected sites until a fix is applied if the plugin is not business-critical
- Disable open user registration or restrict the default new-user role to prevent unauthenticated attackers from acquiring subscriber access
- Back up wp-config.php and the database offline so a deletion event does not become a takeover
Patch Information
No patched version is referenced in the current NVD record. Consult the ThemeForest Item Description and the Wordfence Vulnerability Report for the current vendor guidance and any fixed release announcements.
Workarounds
- Block requests to admin-ajax.php with action=delete_locations_backup_file_callback at the web application firewall (WAF) layer
- Enforce a WAF rule that rejects POST parameters containing ../, ..\, or URL-encoded traversal sequences targeting the plugin action
- Set restrictive filesystem permissions so the PHP process user cannot delete wp-config.php or other files outside the plugin's data directories
- Require an additional capability check via a mu-plugin that short-circuits the vulnerable AJAX action for non-administrator users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
