Path Traversal Vulnerability in PFI Plugin Framework by WordPress

CVE-2026-110935

What is CVE-2026-110935?

A path traversal vulnerability exists in the PFI Plugin Framework due to improper validation of path components when extracting archive entries to the local plugin repository. This flaw allows an unauthenticated local attacker to exploit the system by writing files outside the designated plugin repository. Using relative path segments such as '..', an attacker can gain unauthorized access to arbitrary locations within the server's file system, potentially leading to severe security repercussions, including full system compromise.

References