Wp Foodbakery
Monthly
Arbitrary file deletion in the WP Foodbakery WordPress plugin (all versions through 4.9) lets authenticated users with only subscriber-level access delete any file the web server can reach, because the 'delete_locations_backup_file_callback' handler fails to validate the supplied path. Deleting a critical file such as wp-config.php can cascade into remote code execution, which is why Wordfence tags this as an RCE-class issue. No public exploit has been identified at the time of analysis, but the high CVSS (8.1) and trivially low privilege bar make it a strong patching priority.
Arbitrary file deletion in the WP Foodbakery WordPress plugin (all versions through 4.9) lets authenticated users with only subscriber-level access delete any file the web server can reach, because the 'delete_locations_backup_file_callback' handler fails to validate the supplied path. Deleting a critical file such as wp-config.php can cascade into remote code execution, which is why Wordfence tags this as an RCE-class issue. No public exploit has been identified at the time of analysis, but the high CVSS (8.1) and trivially low privilege bar make it a strong patching priority.