WP Foodbakery subscribers can delete arbitrary server files
WP Foodbakery 4.9 and earlier does not adequately constrain the file path handled by delete_locations_backup_file_callback. Any authenticated user, including a subscriber, can abuse the vulnerable operation to delete files writable by the PHP process. Deleting a critical file such as wp-config.php can take the site offline and may open a path to full site compromise.
- Component
- WP Foodbakery
- Plugin slug
wp-foodbakery- Affected
- <= 4.9
- Safe version
> 4.9- Published
- Jul 22, 2026
- Weakness
- CWE-23 — Relative Path Traversal
This CVE was published Jul 22, 2026 and is one of 5 known issues for this theme.
Patch or disable the affected component.
No fixed release is identified in the source record. Disable WP Foodbakery until a version newer than 4.9 is available and confirmed to fix CVE-2026-15802. Review subscriber accounts and request logs, check the WordPress installation for missing files, and restore affected files from a known-good backup.
Technical description
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H