CVE-2026-77005: CODE MONKEYS PROPOSALS Privilege Escalation

CVE-2026-77005 Overview

CVE-2026-77005 is an arbitrary file deletion vulnerability in the CODE MONKEYS PROPOSALS WordPress plugin through version 1.0.1. The plugin fails to validate user-supplied file paths before deletion and does not verify the capability of the requesting user. Any authenticated user, including low-privileged subscribers, can delete arbitrary files on the server. Deleting critical files such as wp-config.php can trigger WordPress reinstallation flows, enabling full site takeover. The weakness is classified as [CWE-73] External Control of File Name or Path.

Critical Impact
An authenticated subscriber can delete arbitrary files on the WordPress server, leading to site takeover.

Affected Products

CODE MONKEYS PROPOSALS WordPress plugin
Versions through 1.0.1
WordPress installations with the plugin activated

Discovery Timeline

2026-09-12 - CVE-2026-77005 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-77005

Vulnerability Analysis

The CODE MONKEYS PROPOSALS plugin exposes a file deletion endpoint that trusts a client-supplied path parameter. The handler passes the input directly to a file removal call without normalization or allow-list validation. This lets attackers escape the plugin's intended directory using traversal sequences such as ../.

Compounding the issue, the endpoint does not enforce a capability check with current_user_can(). WordPress subscribers, which any visitor can register as when open registration is enabled, retain nonce access to the vulnerable action. The attacker only needs a valid session, not administrative privileges.

Deleting sensitive files produces cascading impact. Removing wp-config.php forces the site into the installation wizard on the next request. An attacker reaching the setup screen first can point the installation at an attacker-controlled database and gain administrator credentials, completing takeover.

Root Cause

Two defects combine into the vulnerability. First, missing path validation permits directory traversal in the file deletion routine. Second, the request handler omits capability enforcement, violating the WordPress principle that destructive actions require appropriate privilege checks.

Attack Vector

Exploitation is remote and network-based. The attacker authenticates as a subscriber, then issues a crafted request to the plugin's file deletion action with a traversal path pointing at a target file. The server processes the deletion in the context of the web server user, removing any file that user can write. Refer to the WPScan Vulnerability Report for the reported technical details.

Detection Methods for CVE-2026-77005

Indicators of Compromise

Missing or truncated wp-config.php, .htaccess, or plugin/theme files without a corresponding administrative action.
HTTP requests to admin-ajax.php or plugin endpoints containing path traversal sequences such as ../ or URL-encoded %2e%2e%2f.
Unexpected appearance of the WordPress installation setup screen at /wp-admin/install.php.
New administrator accounts created shortly after file deletion events.

Detection Strategies

Monitor web server access logs for authenticated POST requests to CODE MONKEYS PROPOSALS plugin actions containing suspicious path parameters.
Compare file integrity baselines of the WordPress core and plugin directories to detect unauthorized deletions.
Alert when subscriber-level accounts invoke plugin AJAX actions that should be restricted to administrators.

Monitoring Recommendations

Enable WordPress audit logging for user registration, capability changes, and plugin AJAX actions.
Ingest web server and PHP error logs into a centralized log platform for correlation across sessions.
Track sudden spikes in subscriber registrations combined with requests to plugin endpoints.

How to Mitigate CVE-2026-77005

Immediate Actions Required

Deactivate and remove the CODE MONKEYS PROPOSALS plugin until a fixed release is available.
Disable open user registration by unchecking the Anyone can register setting under Settings > General.
Restrict access to plugin endpoints at the web server or WAF layer for non-administrative users.
Verify integrity of wp-config.php and back it up outside the web root.

Patch Information

No fixed version is identified in the referenced advisory as of the last modification date. Track the WPScan Vulnerability Report for updates and vendor patch release information.

Workarounds

Remove the plugin entirely if it is not business-critical.
Restrict subscriber-level access by disabling open registration and auditing existing low-privilege accounts.
Deploy a web application firewall rule blocking path traversal patterns in plugin request parameters.
Set filesystem permissions so the web server user cannot delete wp-config.php or other core files.

bash

# Disable open registration and remove the vulnerable plugin
wp option update users_can_register 0
wp plugin deactivate code-monkeys-proposals
wp plugin uninstall code-monkeys-proposals

# Harden wp-config.php permissions
chmod 400 /var/www/html/wp-config.php