Code Monkeys Proposals Plugin Lets Any Subscriber Delete WordPress Files

Executive Summary

A critical arbitrary file deletion vulnerability (CVE-2026-77005) has been disclosed in the Code Monkeys Proposals WordPress plugin. The plugin does not validate a user-supplied file path before deleting a file, and does not check the capability of the requesting user — meaning any authenticated account, down to the lowest-privilege subscriber role, can delete arbitrary files on the server.

CVSS Score: 9.6 (Critical)

Deleting the right file — wp-config.php is the classic target — can force WordPress into a broken state that allows an attacker to walk through the setup wizard again and take over the site outright.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker registers or already holds a subscriber-level WordPress account
2. Attacker sends a request to the plugin's file-deletion handler with a
   crafted file path (no capability check enforced)
3. Plugin deletes the targeted file without validating the path or
   the requesting user's permissions
4. Deleting wp-config.php forces WordPress into the setup wizard,
   letting the attacker point it at a database they control
5. Attacker completes setup as a new administrator — full site takeover

Impact of Successful Exploitation

Immediate Remediation

Step 1: Check for a Patch

No fixed version was available at time of disclosure. Check the plugin's WordPress.org page or WPScan advisory regularly for an update.

wp plugin get code-monkeys-proposals --field=version

Step 2: Restrict or Remove the Plugin

Until a patch ships:

1. Deactivate the Code Monkeys Proposals plugin
2. If deactivation isn't immediately possible, restrict subscriber-level registration (disable open registration, require admin approval)
3. Back up wp-config.php and core files off-server so a deletion can be recovered from quickly

Step 3: Check for Prior Exploitation

# Confirm wp-config.php and other critical files are intact
ls -la wp-config.php wp-load.php
 
# Check web server logs for requests to plugin file-handling endpoints
grep -i "code-monkeys-proposals" /var/log/apache2/access.log

Post-Remediation Steps

1. Apply the vendor patch as soon as one is released
2. Audit subscriber accounts for ones you don't recognize
3. Restore any deleted files from backup and verify WordPress core integrity (wp core verify-checksums)
4. Disable open user registration if not required
5. Deploy file integrity monitoring to catch unauthorized deletions early

References

• OffSeq Threat Radar — CVE-2026-77005 CWE-73 External Control of File Name or Path in CODE MONKEYS PROPOSALS
• VulDB — CVE-2026-77005 in Code Monkeys Proposals Plugin
• NIST NVD — CVE-2026-77005

Related Reading

• WebTotem Backups Plugin Lets Any Subscriber Delete WordPress Files
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+