Arbitrary File Deletion in WP Foodbakery WordPress Plugin

Executive Summary

The WP Foodbakery plugin for WordPress has a flaw in its code that allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server. This happens because the plugin does not properly check file paths before deletion. Attackers could exploit this to remove critical files like wp-config.php, potentially leading to remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file deletions in WordPress directories, especially in the wp-content folder. Review server logs for suspicious activity by authenticated users with subscriber-level access or higher. Look for deletion of critical files like wp-config.php.

Useful 0 Not Useful 0

Impact Analysis

If you use the WP Foodbakery plugin, an attacker with minimal access could delete important files on your server. This might crash your website, expose sensitive data, or allow the attacker to take full control of your site by deleting key configuration files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially exposing or destroying sensitive data. This may violate compliance requirements under GDPR or HIPAA, which mandate protection of personal or health data. Failure to address this could result in legal penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Foodbakery plugin to the latest version if available. Remove the plugin if not needed. Restrict file deletion permissions for subscriber-level users. Monitor server logs for unusual activity and consider disabling file editing in WordPress.

Useful 0 Not Useful 0