ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4350

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1.

Published Apr 3, 2026 · updated Oct 6, 2026

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the method processing the parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to . This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using path traversal sequences, including which would force WordPress into the installation wizard and allow full site takeover.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 3, 2026 · NIST NVD

    Detected

    The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the method processing the parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to . This makes it possible for authenticated attac

  2. Oct 6, 2026 · NIST NVD

    Updated

    The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the method processing the parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to . This makes it possible for authenticated attac

Sources

  • CVE.orgVulnerability recordCVE-2026-4350

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4350

    The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the method processing the parameter without any sanitization, authorization ch

    nvd.nist.gov

References