#Arbitrary File Deletion
All CosmicBytez Labs articles tagged #Arbitrary File Deletion, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-120518 — BuddyPress XProfile Image Field Arbitrary File Deletion
Unauthenticated arbitrary file deletion (CVSS 9.1) in the BuddyPress XProfile Image Field WordPress plugin, versions 3.1.0 and earlier.
- Security
Code Monkeys Proposals Plugin Lets Any Subscriber Delete WordPress Files
CVE-2026-77005 allows low-privilege WordPress users to delete arbitrary server files, including wp-config.php, enabling full site takeover.
- Security
WebTotem Backups Plugin Lets Any Subscriber Delete WordPress Files
CVE-2026-77006 lets low-privilege WordPress users delete arbitrary server files after the plugin discards its own CSRF check result.
- Security
CVE-2026-9725: Critical WordPress WooCommerce Plugin File Deletion
A CVSS 9.1 critical unauthenticated arbitrary file deletion vulnerability in the Printcart Web to Print Product Designer for WooCommerce plugin affects...
- Security
CVE-2026-57331: Critical Arbitrary File Deletion in Paid Videochat Turnkey Site
A CVSS 9.9 critical vulnerability in the Paid Videochat Turnkey Site WordPress plugin allows authenticated performer-role users to delete arbitrary files...