Security Alert Summary
The CODE MONKEYS PROPOSALS WordPress plugin (versions up to and including 1.0.1) contains a file deletion vulnerability. The plugin does not validate a user-supplied file path before deleting a file and does not check the capability of the requesting user. As a result, any authenticated user with low privileges (for example, a subscriber) can delete arbitrary files on the server, which may lead to significant site integrity and availability issues and could contribute to a site takeover.
CVE Details
- CVE ID: CVE-2026-77005
- Affected component: CODE MONKEYS PROPOSALS WordPress plugin
- Affected versions: Versions through 1.0.1 (<= 1.0.1)
- Published: September 12, 2026 at 06:16:24 AM UTC
- Last modified: September 12, 2026 at 04:16:38 PM UTC
- CVSS v3.1: Base Score 9.6, Severity CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
- Authentication / Privileges / User Interaction: Requires authentication with low privileges (PR:L). No user interaction required (UI:N).
- Primary impact: Confidentiality: None; Integrity: High; Availability: High
- CWE / weakness: CWE-73 (External Control of File Name or Path)
Technical Details
The plugin fails to validate a user-supplied file path before performing a file deletion and does not check the capability of the user making the request. Because of these missing checks, any authenticated user with low privileges can trigger deletion of arbitrary files on the server. The vulnerability exists due to insufficient input validation and missing access control checks in the code path that handles file removal.
The CVE description does not name specific functions or REST API endpoints; it identifies the root causes as lack of path validation and lack of capability checks. The practical impact described is deletion of arbitrary files, which directly affects data integrity and availability. The CVSS vector indicates network attackability with low complexity and no user interaction, and that exploitation can change scope, producing high integrity and availability impacts.
How This Could Impact Your Website
In a typical WordPress site with multiple users, an authenticated low-privileged user (for example, a subscriber or a contributor) could exploit this issue to delete files that the web server user can access. For example, an external contractor or a contributor account might be able to remove plugin or theme files, uploaded media, or other files the web process can write to. That deletion can cause site outages, break functionality, or remove security-related files in ways that increase the risk of a follow-on compromise.
Even though the CVSS confidentiality impact is listed as none, file deletion and altered site behavior can indirectly increase the risk of targeted phishing or social engineering against staff and users if site functionality or defenses are impaired. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from the site.
- Monitor site activity and file integrity for unusual behavior, and maintain regular off-site backups.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
