Executive brief
The WebTotem Backups WordPress plugin allows authenticated users, including low-privilege subscribers, to delete arbitrary files from the server due to missing input validation and insufficient permission checks. This vulnerability can lead to complete site takeover by allowing attackers to delete critical application files or configuration data necessary for the WordPress installation to function.
Technical details
The vulnerability is a path traversal and arbitrary file deletion issue caused by inadequate validation of user-supplied file paths, missing capability checks, and a defective CSRF token validation that is ignored. Any authenticated user (including subscribers) can craft requests to delete arbitrary files on the server. The attack requires authentication but no special user role or permissions, making it exploitable by any registered account. The vulnerability is fixed in version 1.1.0 and affects all versions before that release.
Affected products
- WebTotem Backups before 1.1.0
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory
- 2026-09-01: patched: Fixed in version 1.1.0