WP Foodbakery CVE-2026-15802

Exploitation requires an authenticated account with subscriber-level access or above (CVSS PR:L) on a site running the vulnerable WP Foodbakery plugin (<= 4.9) with the 'delete_locations_backup_file_callback' functionality reachable; no user interaction and no elevated privileges are needed (UI:N, AC:L). The main limiting factor is the authentication requirement: an attacker must be able to register or acquire a subscriber account, so sites that disable open registration meaningfully raise the bar. Impact severity in practice also depends on file ownership and permissions - the deletion only succeeds against files writable/deletable by the web-server user, and reaching full RCE additionally requires deleting a security-critical file such as wp-config.php.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1 High) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high integrity and availability impact and no confidentiality loss - consistent with destructive file deletion rather than data theft. The practical risk driver is the extremely low privilege requirement: subscriber accounts are self-registerable on many WordPress sites, effectively lowering the barrier toward unauthenticated in real deployments. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so exploitation is currently unproven rather than confirmed widespread. The RCE claim is a plausible downstream consequence (deleting wp-config.php can drop the site into setup mode enabling attacker takeover) rather than a direct memory-execution primitive - treat it as file-deletion-to-RCE, which is realistic but requires the follow-on step.

An attacker registers or obtains a low-privilege subscriber account on a WordPress site running WP Foodbakery <= 4.9, then sends a crafted AJAX request to the delete_locations_backup_file_callback action with a traversal path pointing at wp-config.php. With that file deleted, the site reverts to an uninitialized state that the attacker can re-provision to seize administrative control or achieve code execution. No public proof-of-concept has been identified, but the low complexity and low privilege requirement make the attack straightforward to reproduce.