PatchSiren cyber security CVE debrief
CVE-2026-4350 perfmatters CVE debrief
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.
- Vendor
- perfmatters
- Product
- Unknown
- CVSS
- HIGH 8.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-03
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-04-03
- Advisory updated
- 2026-07-21
Who should care
WordPress site administrators and owners using the Perfmatters plugin, as well as security teams responsible for monitoring and mitigating vulnerabilities in WordPress plugins. This includes operators managing WordPress deployments, platform administrators overseeing multiple sites, and security teams that need to assess the impact of this vulnerability on their environments.
Technical summary
The vulnerability exists in the Perfmatters plugin for WordPress, specifically in the `PMCS::action_handler()` method. This method processes the `$_GET['delete']` parameter without proper sanitization, authorization checks, or nonce verification. An attacker can exploit this by using path traversal sequences (`../`) to delete arbitrary files on the server, including critical files like `wp-config.php`, which could lead to a full site takeover.
Defensive priority
High
Recommended defensive actions
- Update the Perfmatters plugin to the latest version
- Implement a Web Application Firewall (WAF) to detect and prevent path traversal attacks
- Regularly monitor server logs for suspicious file deletion attempts
- Restrict access to sensitive files and directories
- Use secure protocols for file uploads and deletions
Evidence notes
The CVE record was published on 2026-04-03T08:16:17.547Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD records. Defenders should verify the existence of Perfmatters plugin deployments, review official advisories for affected versions, and monitor for suspicious file deletion attempts.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-03T08:16:17.547Z and has not been modified since then. The NVD entry is currently Deferred.