What is the CVSS score of CVE-2026-15802?

CVE-2026-15802 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WP Foodbakery are affected by CVE-2026-15802?

WP Foodbakery WordPress plugin versions through 4.9 contains an arbitrary file deletion vulnerability requiring only subscriber-level authenticated access.

How to fix or mitigate CVE-2026-15802?

Within 24 hours: Inventory all WordPress sites running WP Foodbakery through version 4.9 and audit active subscriber-level accounts. Within 7 days: Disable the WP Foodbakery plugin entirely, restrict subscriber account capabilities through WordPress role management, or remove unnecessary subscriber-level users. Within 30 days: Monitor vendor and security advisories for patch availability and implement a permanent fix such as upgrading to a patched version or replacing with a secure alternative plugin.

WP Foodbakery CVE-2026-15802

EUVD-2026-47611 HIGH

Relative Path Traversal (CWE-23)

2026-07-22 Wordfence

GHSA-cjgw-jrh4-gfr3

PHP WordPress RCE Wp Foodbakery

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable AJAX action needing only a subscriber account (PR:L, AC:L, UI:N); arbitrary deletion breaks integrity and availability (I:H/A:H) but exposes no data (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 05:16 vuln.today

CVE Published

Jul 22, 2026 - 03:44 cve.org

HIGH 8.1

DescriptionCVE.org

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Articles & Coverage 2

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026 News 5 New PHP Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026

AnalysisAI

Arbitrary file deletion in the WP Foodbakery WordPress plugin (all versions through 4.9) lets authenticated users with only subscriber-level access delete any file the web server can reach, because the 'delete_locations_backup_file_callback' handler fails to validate the supplied path. Deleting a critical file such as wp-config.php can cascade into remote code execution, which is why Wordfence tags this as an RCE-class issue. No public exploit has been identified at the time of analysis, but the high CVSS (8.1) and trivially low privilege bar make it a strong patching priority.

Technical ContextAI

The affected code is a WordPress AJAX/callback handler ('delete_locations_backup_file_callback') exposed by the ChimpStudio WP Foodbakery plugin, a restaurant/bakery add-on distributed with the ThemeForest 'Food Bakery' theme. The root cause is CWE-23 (Relative Path Traversal): the function accepts a user-controlled filename or path and passes it to a PHP file-deletion routine (e.g. unlink()) without canonicalizing or constraining it to an intended backup directory, so sequences like '../' let the caller escape into the WordPress root or system paths. Because WordPress runs under a single web-server identity, any file that identity owns - including wp-config.php, plugin files, or .htaccess - is deletable.

RemediationAI

No vendor-released patch version is identified in the available data; the fix is expected in a release later than 4.9, so administrators should update WP Foodbakery to the latest available version from ChimpStudio/ThemeForest as soon as one is published and confirm it post-dates 4.9. Until a confirmed patched build is installed, apply compensating controls: disable open user registration or restrict the subscriber role (Settings > General, uncheck 'Anyone can register') to remove the self-service foothold this attack relies on; deploy a WAF or Wordfence rule to block requests to the 'delete_locations_backup_file_callback' AJAX action; and if the plugin is not essential, deactivate and remove it. As a safety net, ensure wp-config.php and the site are backed up and, where the platform allows, make wp-config.php read-only/immutable so a stray deletion cannot succeed - noting this can interfere with legitimate config-writing operations. Reference the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/45c8d883-1f97-4c9d-b406-c61e33a0959e?source=cve) for updated fix guidance.