Description

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-12T06:16:24.733Z",
  "pubdate": "2026-09-12T06:16:24.733Z",
  "executiveSummary": "The WebTotem Backups WordPress plugin through version 1.0.1 contains a critical security flaw involving improper input validation and broken access control.\nThis vulnerability is classified as an Arbitrary File Deletion issue, enabling authenticated users with minimal privileges—such as subscribers—to delete sensitive files from the underlying server filesystem.\nThe flaw stems from a lack of server-side capability verification and the failure to enforce CSRF protection, allowing an attacker to manipulate file paths during the deletion process.\nThe impact of this vulnerability is severe; successful exploitation can result in a complete site takeover by removing critical WordPress configuration files, such as wp-config.php, or essential plugin and theme components.\nThis vulnerability is reachable by any authenticated user on the WordPress site, requiring no elevated administrative privileges for execution.\nThe risk implication is high, as the ability to delete arbitrary files often facilitates privilege escalation or remote code execution scenarios when combined with subsequent application reconfiguration.",
  "technicalDetails": "The root cause of this vulnerability lies in the WebTotem Backups plugin's file handling logic, which fails to implement strict input sanitization or path validation when processing deletion requests.\nThe plugin exposes an endpoint designed for administrative file management that lacks essential security checks. Specifically, the implementation fails to utilize WordPress's 'current_user_can()' function or equivalent capability checks, allowing unauthorized users to invoke sensitive administrative functions.\nFurthermore, while the plugin contains a CSRF check implementation, it fails to enforce or validate the result of this check before proceeding with the file system operation. This renders the CSRF protection effectively non-existent, permitting the execution of unauthorized requests.\nThe attack flow begins with an attacker authenticated as a subscriber navigating to the vulnerable request handler. By crafting a specific HTTP request, the attacker can supply an arbitrary string representing a file path in the 'file' parameter (or equivalent argument) used by the plugin's deletion routine.\nBecause the plugin does not constrain this input to a specific, safe directory (such as a restricted uploads folder) nor validates the path against the WordPress document root, the application proceeds to execute the PHP 'unlink()' function on the provided path with the privileges of the web server process.\nThe scope of this vulnerability allows for the deletion of any file readable and writable by the web server user. A common attack vector involves deleting 'wp-config.php'. Removing this file forces the WordPress installation screen to reappear upon the next page load, potentially allowing an attacker to reconfigure the database connection or perform an unauthorized site re-installation, leading to total administrative control.\nAlternatively, an attacker could target plugin or theme files, disabling security plugins or creating a denial-of-service condition to facilitate further exploitation. Because the request relies solely on the user's ability to authenticate to the platform, the attack surface is limited only by the web server's ability to resolve the attacker-provided path.\nAffected versions include all iterations of the WebTotem Backups plugin through version 1.0.1. The vulnerability is local to the server environment but accessible via standard HTTP/HTTPS protocols, making it a critical threat to any WordPress environment with user registration enabled."
}