https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T06:20:34.829036+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-77006 CVE-2026-77006 — WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal 2026-10-01T06:20:35.744777+00:00

Affected: Unknown WebTotem Backups

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.