WebTotem Backups lets subscribers delete arbitrary server files
WebTotem Backups through 1.0.1 passes a caller-controlled path to file deletion without validating the path or checking user capability, and it discards the result of its CSRF check. Any authenticated user, including a subscriber, can delete arbitrary server files and potentially take over the site. The authoritative export does not name the action or path parameter.
- Component
- WebTotem Backups
- Plugin slug
webtotem-backups- Affected
- <= 1.0.1
- Safe version
- See mitigation notes
- Published
- Sep 12, 2026
This CVE was published Sep 12, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed release is confirmed in the authoritative export. Deactivate the plugin pending remediation and restore deleted files from known-good backups if exploitation is suspected. The fix must require an administrative capability, enforce the CSRF result, resolve paths inside an allowlisted backup directory, and reject traversal and symlinks.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H