{"id":"CVE-2026-78530","published":"2026-10-10T20:16:46.710","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/foodbakery/vulnerability/wordpress-foodbakery-theme-4-6-arbitrary-file-deletion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The FoodBakery plugin allows authenticated subscribers to delete arbitrary files on the server through a vulnerability in the file deletion functionality. This could lead to remote code execution or data loss if attackers can manipulate the deletion process to target critical system files.","exploitability":"Exploitation requires an authenticated subscriber account with minimal privileges, making it moderately difficult but achievable through social engineering or credential compromise.","blast_radius":"If exploited, this vulnerability could allow attackers to delete critical application files, configuration data, or even database files, potentially leading to complete application downtime or unauthorized access to sensitive customer information.","remediation":"Upgrade to FoodBakery version 4.7 or later to address this arbitrary file deletion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["file-deletion","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:06.144Z"}}