Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-15802 Arbitrary File Deletion in WP Foodbakery Plugin for WordPress Up to 4.9 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15802
Post summary
The text announces CVE‑2026‑15802 as an arbitrary file deletion vulnerability affecting WP Foodbakery plugin versions up to 4.9, with no exploit code or active exploitation indicated.