CVE-2026-15802

Name of the Vulnerable Software and Affected Versions WP Foodbakery versions prior to 4.10

Description The WP Foodbakery plugin for WordPress contains a flaw allowing authenticated users with subscriber-level access or higher to delete arbitrary files on the server. This occurs due to insufficient file path validation within the delete locations backup file callback() function, specifically when processing the delete locations backup file AJAX action. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update the plugin to a version later than 4.9. As a temporary mitigation, restrict access to the delete locations backup file callback() function for users with subscriber-level permissions.