CVE-2026-104801: PPOM WooCommerce Path Traversal Flaw

CVE-2026-104801 Overview

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains an arbitrary file deletion vulnerability in the rename_files function. All versions up to and including 34.0.10 are affected. The flaw stems from insufficient file path validation, allowing unauthenticated attackers to delete arbitrary files on the server.

Deletion of sensitive files such as wp-config.php can escalate the issue into remote code execution. The targeted file is also relocated byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, producing arbitrary file read of any web-readable file on the server.

Critical Impact
Unauthenticated attackers can delete and read arbitrary server files, enabling site takeover through wp-config.php manipulation and exposure of secrets.

Affected Products

PPOM – Product Addons & Custom Fields for WooCommerce (WordPress plugin)
All versions up to and including 34.0.10
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2026-10-10 - CVE-2026-104801 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104801

Vulnerability Analysis

The vulnerability resides in the plugin's file handling pipeline, specifically in the rename_files function referenced in src/Files/Handler.php, src/Support/Helpers.php, src/WooCommerce/Cart/CartHandler.php, and src/WooCommerce/Order/OrderHandler.php. The function processes attacker-controlled file path input without properly validating or canonicalizing the resulting path.

Because the operation is reachable via unauthenticated WooCommerce cart and order flows, no account or session is required. The affected codepath moves (renames) the targeted file into the plugin's public upload directory, which both removes the file from its original location and discloses its contents through a predictable URL.

When the targeted file is wp-config.php, deletion disrupts WordPress bootstrap and can enable an attacker to trigger the setup wizard. Pointing the setup wizard at an attacker-controlled database yields full administrator access and remote code execution via plugin or theme upload.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22], commonly known as path traversal. The rename_files function trusts user-supplied path components when constructing the source path passed to the rename operation, failing to constrain the input to the intended uploads directory.

Attack Vector

Exploitation requires only network access to the WooCommerce storefront. An unauthenticated attacker submits a crafted request through the vulnerable cart or order endpoint, supplying a file path that traverses outside the intended uploads directory. See the Wordfence Vulnerability Report and the vulnerable source in Handler.php for technical details.

Detection Methods for CVE-2026-104801

Indicators of Compromise

Unexpected files appearing under wp-content/uploads/ppom_files/confirmed/ that match the names or contents of core WordPress or application files.
Missing or truncated wp-config.php, .htaccess, or plugin PHP files on the WordPress host.
HTTP requests to PPOM cart or order endpoints containing path traversal sequences such as ../ in file name parameters.
WordPress setup wizard (/wp-admin/setup-config.php) becoming reachable on a previously configured site.

Detection Strategies

Inspect web server access logs for POST requests to WooCommerce cart and order handlers that include encoded or raw traversal tokens in PPOM file parameters.
Monitor filesystem events on the WordPress document root for unexpected rename or unlink operations against wp-config.php and other sensitive files.
Compare file inventories of wp-content/uploads/ppom_files/confirmed/ against expected customer upload activity.

Monitoring Recommendations

Alert on any read access to files under wp-content/uploads/ppom_files/confirmed/ whose names match core WordPress files.
Track plugin version inventory across WordPress fleets and flag hosts running PPOM at or below version 34.0.10.
Enable integrity monitoring on wp-config.php, .htaccess, and the active theme and plugin directories.

How to Mitigate CVE-2026-104801

Immediate Actions Required

Update the PPOM – Product Addons & Custom Fields for WooCommerce plugin to a version later than 34.0.10 that contains the fix referenced in ChangeSet #3733313.
Audit wp-content/uploads/ppom_files/confirmed/ for files that should not be there and remove or quarantine them.
Rotate database credentials, authentication keys, salts, and any API keys stored in wp-config.php if exposure is suspected.
Verify that wp-config.php and other core files are present, intact, and match expected hashes.

Patch Information

The vendor addressed the vulnerability in the commit referenced by WordPress plugin repository ChangeSet #3733313, which modifies src/WooCommerce/Order/OrderHandler.php to properly validate file paths. Site operators should upgrade PPOM to the patched release immediately. Review the patch changeset for the exact code changes.

Workarounds

Deactivate and remove the PPOM plugin until it can be upgraded to a fixed version.
Block web requests containing path traversal patterns in parameters associated with PPOM cart and order endpoints at the WAF or reverse proxy.
Restrict web server write access to directories outside wp-content/uploads/ so that rename operations against core files fail.
Deny public HTTP access to wp-content/uploads/ppom_files/confirmed/ with server configuration until the plugin is patched.

bash

# Example nginx rule to block traversal in PPOM parameters
location ~* /\?.*ppom.*\.\./ {
    return 403;
}

# Deny direct access to the confirmed uploads path
location ^~ /wp-content/uploads/ppom_files/confirmed/ {
    deny all;
}