Vulnerability · Published Sep 12, 2026 · Assigned by WPScan
CVE-2026-77006WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
Critical 9.6
In plain English
A critical-severity security flaw in WebTotem Backups from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.2%top 83.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WebTotem Backups | 0 – before 1.1.0 |
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
References
- https://wpscan.com/vulnerability/71bc08cb-681c-44bd-b6a0-bb5c58e31653/ exploit, vdb-entry, technical-description