CVE-2026-13251 Overview
CVE-2026-13251 is a directory traversal vulnerability in the Perfmatters plugin for WordPress affecting all versions up to and including 2.6.4. The flaw resides in the handling of the s parameter and allows unauthenticated attackers to read arbitrary files on the underlying server. Exploitation depends on three conditions: the Local Google Fonts feature must be enabled (disabled by default), pretty permalinks must be active, and RSS feed links must remain enabled in plugin settings. Retrieved files can expose configuration data, credentials, and other sensitive information stored on the host.
Critical Impact
Unauthenticated remote attackers can read arbitrary files on affected WordPress servers, potentially exposing wp-config.php credentials, private keys, and other sensitive data.
Affected Products
- Perfmatters plugin for WordPress, versions up to and including 2.6.4
- WordPress sites with Local Google Fonts feature enabled
- WordPress sites with pretty permalinks and RSS feed links enabled
Discovery Timeline
- 2026-07-02 - CVE-2026-13251 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-13251
Vulnerability Analysis
The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The Perfmatters plugin fails to sanitize the s query parameter used by the Local Google Fonts feature before incorporating it into a file path. As a result, an attacker can supply traversal sequences such as ../ to escape the intended fonts directory and reference arbitrary files on the server.
Because the vulnerable code path is reachable without authentication, any unauthenticated visitor can send a crafted request. Exploitation succeeds when the site operator has explicitly enabled Local Google Fonts, kept pretty permalinks active, and left RSS feed links enabled. These prerequisites limit the attack surface but do not require any user interaction once met.
Root Cause
The root cause is missing input validation in the Fonts class (see the referenced source at inc/classes/Fonts.php). The s parameter is passed to file-reading logic without normalizing the path or restricting it to the plugin's expected directory. The plugin does not enforce an allowlist of permitted filenames or a canonicalized base directory check before performing file I/O.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker issues an HTTP GET request to the affected endpoint with a traversal payload in the s parameter. The server responds with the contents of the targeted file, such as wp-config.php, .env, or /etc/passwd, depending on filesystem permissions. See the Wordfence Vulnerability Analysis and the WordPress Fonts Class Code Review for technical details.
No verified public exploit code is available at the time of publication. The vulnerability mechanism is described in prose only.
Detection Methods for CVE-2026-13251
Indicators of Compromise
- HTTP requests to Perfmatters endpoints containing traversal sequences such as ../, ..%2f, or encoded variants in the s parameter.
- Web server access logs showing unauthenticated requests referencing paths outside the plugin's fonts directory.
- Unexpected reads of sensitive files like wp-config.php, .env, or SSH keys correlated with plugin request patterns.
Detection Strategies
- Deploy web application firewall rules that inspect the s query parameter for path traversal patterns and encoded variants.
- Correlate HTTP request logs with file access telemetry to identify unauthenticated reads of sensitive server files.
- Review Perfmatters plugin configuration to confirm whether Local Google Fonts, pretty permalinks, and RSS feed links are all enabled, which indicates an exploitable state.
Monitoring Recommendations
- Alert on any HTTP 200 response to requests containing ../ sequences against WordPress endpoints.
- Monitor outbound traffic for exfiltration of file contents following suspicious inbound requests.
- Track plugin version inventory across WordPress deployments to flag hosts running Perfmatters 2.6.4 or earlier.
How to Mitigate CVE-2026-13251
Immediate Actions Required
- Update the Perfmatters plugin to a version later than 2.6.4 that addresses this directory traversal issue.
- Disable the Local Google Fonts feature if a patched version is not yet available.
- Rotate any credentials that may have been exposed through wp-config.php or other readable configuration files.
Patch Information
Review the Perfmatters Changelog for the fixed release and apply the update through the WordPress plugin management interface. Confirm the installed version after upgrade to ensure the vulnerable code path is remediated.
Workarounds
- Disable the Local Google Fonts feature in Perfmatters settings to eliminate the vulnerable code path.
- Disable RSS feed links in the plugin configuration to break the exploitation prerequisite chain.
- Deploy WAF rules that block traversal sequences in the s parameter until the plugin is upgraded.
# Example WAF rule pattern to block traversal in the 's' parameter
# ModSecurity example
SecRule ARGS:s "@rx (\.\./|\.\.%2f|\.\.\\)" \
"id:1026132510,phase:2,deny,status:403,msg:'Perfmatters CVE-2026-13251 traversal attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
