FoodBakery CVE-2026-78530

Requires an authenticated WordPress account at Subscriber level (PR:L) on a site running the FoodBakery theme version 4.6 or earlier; no user interaction is needed. Practically, exploitation is gated by whether the site allows the attacker to hold a Subscriber account - on sites with open self-registration (common for ordering/membership themes) this barrier is trivial, while sites that disable registration or restrict accounts meaningfully limit exposure. The underlying path-traversal flaw (CWE-22) implies an unsanitized file-path parameter in a theme-exposed action; the scope change (S:C) and arbitrary file deletion mean an attacker can reach files outside the intended directory, including critical files such as wp-config.php, which escalates impact from simple DoS toward full site compromise.

This is a moderately serious, authentication-gated vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, score 7.7) indicates a low-complexity, network-reachable path-traversal flaw requiring only low privileges - a WordPress Subscriber account, the lowest authenticated role - with a scope change and high availability impact from arbitrary file deletion. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data; per rules this is 'no public exploit identified at time of analysis.' The key risk amplifier is the low privilege barrier: on WordPress sites that leave open user registration enabled (a common default for membership/ordering themes like FoodBakery), an attacker can self-provision the Subscriber account needed, effectively lowering PR:L toward unauthenticated reach. The key risk limiter is that it requires a valid account and the impact is deletion/availability (and potential integrity via deleting wp-config.php), not direct code execution or data disclosure. Net: a real patch-soon priority for exposed FoodBakery sites with open registration, but not a drop-everything issue absent evidence of active exploitation. Conflicting-signal note: the vector rates impact purely as A:H with C:N/I:N, yet arbitrary deletion of critical files like wp-config.php arguably carries integrity consequences and can enable full site takeover via re-installation - verify impact scope with the Patchstack advisory.

An attacker registers (or obtains) a low-privilege Subscriber account on a FoodBakery-based WordPress site and sends a crafted request to a theme endpoint that fails to sanitize a file-path parameter. Using path-traversal sequences, they delete arbitrary files on the server - for example wp-config.php, which can force WordPress into its setup state and enable site takeover, or other files causing denial of service. No public exploit code was identified at time of analysis, and no user interaction is required.