CVE-2026-4350
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The Perfmatters plugin for WordPress up to version 2.5.9.1 is vulnerable to arbitrary file deletion via path traversal. The `PMCS::action_handler()` method processes the `$_GET['delete']` parameter without sanitization, authorization, or nonce verification, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server.
Risk Assessment
An attacker can delete the `wp-config.php` file, forcing WordPress into the installation wizard and enabling full site takeover. This poses risks of data loss, service disruption, and complete system compromise.
Recommendation
Immediately update the Perfmatters plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin until a patch is released.
Other vulnerabilities in Perfmatters
See all- CVE-2026-57671High
The Perfmatters plugin version 2.6.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-13251High
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.6.4 via the 's' parameter. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information.
Original NVD description (English source)
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.