CVE-2026-77006 Overview
CVE-2026-77006 affects the WebTotem Backups WordPress plugin through version 1.0.1. The plugin fails to validate user-supplied file paths, skips capability checks on the requesting user, and discards the result of its own Cross-Site Request Forgery (CSRF) check. Any authenticated user, including a subscriber-level account, can delete arbitrary files on the server. Deletion of core files such as wp-config.php can force WordPress into setup mode and enable a full site takeover. The issue is tracked under CWE-73: External Control of File Name or Path.
Critical Impact
A subscriber-level account can delete arbitrary files on the underlying server, leading to site takeover.
Affected Products
- WebTotem Backups WordPress plugin, versions up to and including 1.0.1
- WordPress sites with the plugin installed and any authenticated user role available
- Multisite installations exposing the vulnerable endpoint to subscriber accounts
Discovery Timeline
- 2026-09-12 - CVE-2026-77006 published to the National Vulnerability Database (NVD)
- 2026-09-14 - CVE-2026-77006 last modified in NVD
Technical Details for CVE-2026-77006
Vulnerability Analysis
The WebTotem Backups plugin exposes a file management action that accepts a file path from the HTTP request and performs a deletion on the server file system. Three independent security controls fail simultaneously in the vulnerable code path. First, the plugin does not sanitize or constrain the supplied path, allowing traversal outside the plugin's working directory. Second, it does not enforce a WordPress capability check, so any logged-in role, including subscriber, can invoke the action. Third, the CSRF nonce check runs but its return value is ignored, so requests without a valid nonce still execute.
When combined, these flaws let an attacker with the lowest privilege account remove any file the web server user can access. Deleting wp-config.php triggers the WordPress installer on the next request, allowing the attacker to reconnect the site to a database under their control and register an administrator account.
Root Cause
The root cause is improper access control layered with unsafe file handling. Under [CWE-73], the plugin passes attacker-controlled input to a filesystem deletion routine without validating that the resolved path stays within an allowed directory. Missing current_user_can() enforcement and the discarded check_ajax_referer() result compound the flaw.
Attack Vector
Exploitation is remote and network-based. An attacker registers or authenticates as a subscriber, then issues a crafted request to the plugin's file deletion handler with a path parameter pointing to a target file such as ../../../../wp-config.php. No user interaction is required beyond the attacker's own session, and the scope changes because the impact extends to the entire WordPress installation.
Refer to the WPScan Vulnerability Report for endpoint and parameter specifics.
Detection Methods for CVE-2026-77006
Indicators of Compromise
- Unexpected HTTP POST requests from low-privilege authenticated users to WebTotem Backups plugin endpoints containing path traversal sequences such as ../
- Missing or truncated wp-config.php, .htaccess, or plugin/theme files followed by WordPress entering setup mode
- New administrator accounts created after a site is reconnected to an attacker-controlled database
- Web server error logs referencing deleted PHP files immediately after plugin AJAX calls
Detection Strategies
- Alert on file deletion events in the WordPress document root originating from the PHP-FPM or web server process outside of scheduled maintenance windows
- Inspect access logs for requests to admin-ajax.php or plugin routes from accounts with non-administrative roles
- Correlate authentication events for subscriber accounts with subsequent filesystem write or delete activity
Monitoring Recommendations
- Enable WordPress audit logging for user role activity, plugin actions, and failed nonce checks
- Monitor filesystem integrity on wp-config.php, index.php, and files inside wp-admin/ and wp-includes/
- Forward web server and PHP logs to a centralized analytics platform to identify traversal patterns in request parameters
How to Mitigate CVE-2026-77006
Immediate Actions Required
- Deactivate and remove the WebTotem Backups plugin on all sites running version 1.0.1 or earlier until a fixed release is available
- Restrict user registration and disable open subscriber signup on public WordPress sites where the plugin cannot be removed immediately
- Rotate WordPress database credentials and administrator passwords if file deletion or unauthorized setup activity is observed
Patch Information
At the time of publication, no fixed version is listed in the WPScan Vulnerability Report for CVE-2026-77006. Administrators should uninstall the plugin until the vendor releases a patched build that enforces capability checks, validates the CSRF nonce return value, and constrains file paths to the plugin's own directory.
Workarounds
- Block requests to the vulnerable plugin endpoints at a web application firewall (WAF) using rules that reject path traversal sequences in POST parameters
- Set filesystem permissions so the web server user cannot delete critical files such as wp-config.php outside of controlled maintenance operations
- Limit authenticated access to the WordPress admin surface using IP allowlists or an authenticating reverse proxy
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate webtotem-backups
wp plugin uninstall webtotem-backups
# Verify the plugin directory is gone
ls -la wp-content/plugins/ | grep -i webtotem
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.