Arbitrary File Overwrite Vulnerability in Perfmatters Plugin for WordPress

CVE-2026-4351

What is CVE-2026-4351?

The Perfmatters plugin for WordPress is exposed to an arbitrary file overwrite vulnerability due to improper handling of user inputs in its activation and deactivation processes. In all versions up to and including 2.5.9, the PMCS::action_handler() method processes the bulk action handlers without adequate authorization checks or nonce verification. Attackers with Subscriber-level access can exploit this vulnerability by passing unsanitized values through $_GET['snippets'][], triggering unsafe function calls that can overwrite critical server files, such as .htaccess or index.php, potentially leading to service disruptions.

References