A critical vulnerability in the WebTotem Backups WordPress plugin allows any authenticated user to perform arbitrary file deletion, posing a severe risk of complete site compromise.

This vulnerability involves improper validation of user-supplied file paths and a lack of capability checks for sensitive operations. Any authenticated user, including those with minimal privileges such as a subscriber, can trigger the deletion of arbitrary server files by bypassing the plugin's security controls.

The ability for low-privileged users to delete arbitrary files on the server creates a direct path to site takeover or total service disruption. With a CVSS score of 9.6, this flaw is categorized as critical because it allows for the destruction of core system files or configuration files, which can result in permanent data loss, unauthorized downtime, and reputational damage to the organization.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate and remove the WebTotem Backups plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should audit web server logs for suspicious file system modification requests or unauthorized POST requests targeting the plugin's backup management endpoints.

Compensating Controls: If the plugin must remain active, implement a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns or unauthorized attempts to access plugin-specific administrative functions.

Public Exploit Available: Unknown

Given the critical severity of this vulnerability and the potential for complete site takeover, immediate action is required. Organizations should prioritize the removal of the vulnerable plugin from all WordPress environments until the vendor provides a verified security update, as no reliable compensating control can fully mitigate the risk of arbitrary file deletion.