CVE-2026-78530

Summary

The FoodBakery plugin allows authenticated subscribers to delete arbitrary files on the server through a vulnerability in the file deletion functionality. This could lead to remote code execution or data loss if attackers can manipulate the deletion process to target critical system files.

Exploitability

Exploitation requires an authenticated subscriber account with minimal privileges, making it moderately difficult but achievable through social engineering or credential compromise.

Blast radius

If exploited, this vulnerability could allow attackers to delete critical application files, configuration data, or even database files, potentially leading to complete application downtime or unauthorized access to sensitive customer information.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FoodBakery version 4.7 or later to address this arbitrary file deletion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.