CVE-2026-77006 WebTotem CVE debrief

Who should care

WordPress site administrators, security teams, and users with subscriber or higher roles should assess exposure and apply patches or mitigations to prevent potential site takeover and data loss. Verifying exposure and applying patches or updates for the WebTotem Backups plugin is of high priority to prevent arbitrary file deletion on the server and bypass of access controls and CSRF protections.

Why it matters

CVE-2026-77006 is a critical vulnerability in the WebTotem Backups WordPress plugin that allows any authenticated user to delete arbitrary files on the server, potentially leading to site takeover. WordPress site administrators and security teams should verify exposure and apply patches or mitigations.

• Potential site takeover by authenticated users.
• Arbitrary file deletion on the server.
• Bypass of access controls and CSRF protections.
• Possible data loss and service disruption.

Technical summary

The WebTotem Backups WordPress plugin before 1.1.0 does not validate user-supplied file paths, lacks proper user capability checks, and ignores CSRF checks, allowing any authenticated user to delete arbitrary files on the server. This vulnerability can lead to potential site takeover, data loss, and service disruption. The plugin's insufficient validation and authorization checks enable attackers to bypass access controls and CSRF protections, resulting in critical vulnerability with a CVSS score of 9.6 and CRITICAL severity.

Defensive priority

High priority for WordPress site administrators and security teams to verify exposure and apply patches.

Recommended defensive actions

• Verify if the WebTotem Backups WordPress plugin is installed and outdated.
• Assess user authentication and authorization controls.
• Apply patches or updates for the WebTotem Backups plugin.
• Monitor server file system for unauthorized changes.
• Review user roles and permissions.

Evidence notes

The vulnerability allows any authenticated user, such as a subscriber, to delete arbitrary files on the server due to insufficient validation of user-supplied file paths and lack of proper authorization checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.