Arbitrary File Deletion in Perfmatters Plugin for WordPress

CVE-2026-4350

What is CVE-2026-4350?

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion, allowing authenticated users with Subscriber-level access and above to exploit path traversal techniques. The issue arises from the PMCS::action_handler() method, which fails to sanitize, authorize, or verify the nonce of the $_GET['delete'] parameter. Consequently, an attacker could craft a request using ../ sequences to manipulate file paths, leading to the deletion of critical files such as wp-config.php. This vulnerability poses a significant risk of unauthorized access and potential full site takeover.

References