PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4350 perfmatters CVE debrief

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.

Vendor
perfmatters
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-21
Advisory published
2026-04-03
Advisory updated
2026-07-21

Who should care

WordPress site administrators and owners using the Perfmatters plugin, as well as security teams responsible for monitoring and mitigating vulnerabilities in WordPress plugins. This includes operators managing WordPress deployments, platform administrators overseeing multiple sites, and security teams that need to assess the impact of this vulnerability on their environments.

Technical summary

The vulnerability exists in the Perfmatters plugin for WordPress, specifically in the `PMCS::action_handler()` method. This method processes the `$_GET['delete']` parameter without proper sanitization, authorization checks, or nonce verification. An attacker can exploit this by using path traversal sequences (`../`) to delete arbitrary files on the server, including critical files like `wp-config.php`, which could lead to a full site takeover.

Defensive priority

High

Recommended defensive actions

  • Update the Perfmatters plugin to the latest version
  • Implement a Web Application Firewall (WAF) to detect and prevent path traversal attacks
  • Regularly monitor server logs for suspicious file deletion attempts
  • Restrict access to sensitive files and directories
  • Use secure protocols for file uploads and deletions

Evidence notes

The CVE record was published on 2026-04-03T08:16:17.547Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD records. Defenders should verify the existence of Perfmatters plugin deployments, review official advisories for affected versions, and monitor for suspicious file deletion attempts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4350 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4350

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4350 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4350

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.