CVE-2026-78530 in FoodBakery Plugin
Summary
by MITRE • 10/10/2026
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified as an arbitrary file deletion flaw within FoodBry versions prior to or equal to 4.6 represents a critical security deficiency that allows authenticated subscribers to remove files from the server filesystem without proper authorization checks. This type of vulnerability falls under the category of Improper Limitation of a Pathname to a Restricted Directory, commonly referenced in industry standards as CWE-22 if it involves directory traversal leading outside intended boundaries, or more specifically CWE-59 when dealing with symbolic link attacks, though arbitrary file deletion is often categorized under CWE-377: Insecure Temporary File Creation and Deletion or CWE-618: Exposed Unsafe ActiveX Method depending on the specific implementation mechanism. The core technical flaw typically stems from a lack of validation on user-supplied input that dictates which files are targeted for removal by an administrative function or a file management utility within the application's backend logic.
In the context of FoodBakery, a WordPress plugin designed to facilitate food ordering and restaurant management systems, this vulnerability is particularly severe because it leverages the privileges granted to subscriber-level users, who generally have limited access rights but are trusted with basic profile interactions. An attacker exploiting this flaw can manipulate parameters passed to file deletion endpoints or functions, potentially bypassing checks that restrict operations to specific directories such as uploads or plugin assets. By supplying crafted input containing relative paths or absolute path sequences, the malicious actor instructs the server-side script to delete arbitrary files located anywhere on the disk where the web service process has write permissions. This capability effectively transforms a low-privilege account into a potent vector for system compromise.
The operational impact of this vulnerability extends beyond simple data loss and encompasses significant risks to availability and integrity. An attacker can deliberately remove critical configuration files, database connection scripts, or core plugin components, leading to service disruption and denial of access for legitimate users. Furthermore, the deletion of security-related logs or audit trails hinders incident response efforts by obscuring evidence of prior attacks. In more sophisticated attack chains, this vulnerability may serve as a precursor to remote code execution if an attacker can delete files that are subsequently replaced with malicious content through other upload mechanisms, although in its pure form, it primarily facilitates destructive actions against the application's infrastructure and data integrity.
Mitigation strategies for this vulnerability require immediate action by system administrators and developers. The primary remediation is to upgrade FoodBakery to a version newer than 4.6 where these input validation gaps have been addressed through rigorous sanitization of file paths and strict enforcement of access control lists that prevent subscribers from invoking administrative deletion functions. Additionally, implementing principle of least privilege ensures that even if the vulnerability were present in other components, the impact would be contained by restricting filesystem permissions for the web server process to only necessary directories. Regular security audits focusing on input validation patterns and adherence to secure coding standards such as those outlined in OWASP guidelines are essential to prevent similar flaws from being introduced or persisting in legacy codebases.