Security Alert Summary
The WP Foodbakery plugin contains an arbitrary file deletion vulnerability in the delete_locations_backup_file_callback function. Authenticated users with subscriber-level access and above can delete files on the server due to insufficient file path validation, which can lead to integrity and availability damage and may enable remote code execution if critical files are removed.
CVE Details
- CVE ID: CVE-2026-15802
- Affected component: WP Foodbakery plugin (Chimpstudio)
- Affected versions: All versions up to and including 4.9
- Published: July 22, 2026 at 05:17:08 AM UTC
- Last modified: July 22, 2026 at 04:30:26 PM UTC
- CVSS v3.1: Base Score 8.1, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Authentication / privileges / user interaction: Authenticated attacker with low privileges required (subscriber-level and above); no user interaction required
- Primary impact: Confidentiality: None; Integrity: High; Availability: High
- CWE / weakness: CWE-23 (Relative Path Traversal)
Technical Details
The vulnerability arises from insufficient file path validation in the plugin function delete_locations_backup_file_callback. Because the function does not adequately validate or sanitize file paths, authenticated users with subscriber-level access or higher can request deletion of arbitrary files on the server. The description notes that deletion of certain files, such as wp-config.php, can lead to remote code execution when the right file is removed.
This is an authorization and input-validation weakness: the plugin accepts a file path parameter and does not enforce safe path handling or restrict deletions to an intended directory. The impact is modification or removal of files (integrity and availability), rather than direct disclosure of confidential data, per the CVSS metrics provided.
How This Could Impact Your Website
In a typical multi-user WordPress site, the site owner manages plugins and higher-level roles, internal staff such as editors perform content tasks, and external contractors or contributors may have lower-level accounts. If a subscriber-level or higher account is compromised or misused, an attacker could use this vulnerability to delete files that the plugin is allowed to operate on. Practical consequences include site outages or broken functionality if configuration or application files are removed, and the potential for an attacker to create conditions that enable further compromise.
For example, an attacker with a compromised contributor account could delete backup or configuration files that are required for the site to operate, causing downtime while files are restored. While the CVSS data indicates no direct confidentiality impact, the resulting loss of integrity or availability can disrupt operations and require recovery work.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles; limit permissions for contributors and subscribers.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual file deletion or maintenance operations.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
