CVE-2026-4351: Perfmatters WordPress Path Traversal Flaw

CVE-2026-4351 Overview

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This vulnerability exists due to the PMCS::action_handler() method processing bulk action activate/deactivate handlers without any authorization check or nonce verification. The $_GET['snippets'][] values are passed unsanitized to Snippet::activate()/Snippet::deactivate() which call Snippet::update() then file_put_contents() with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like .htaccess or index.php.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can overwrite critical server files, potentially causing complete denial of service by corrupting essential WordPress files.

Affected Products

• Perfmatters WordPress Plugin version 2.5.9 and earlier
• WordPress installations using vulnerable Perfmatters versions
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-4351 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-4351

Vulnerability Analysis

This path traversal vulnerability (CWE-22) stems from improper handling of user-supplied input in the Perfmatters plugin's snippet management functionality. The vulnerability chain begins when the PMCS::action_handler() method processes bulk actions without performing authorization checks or nonce verification, a critical security oversight that bypasses WordPress's built-in protection mechanisms.

The core issue lies in how user-controllable $_GET['snippets'][] values flow through the application. These values pass unsanitized through Snippet::activate() and Snippet::deactivate() methods, which subsequently call Snippet::update(). The final dangerous operation occurs when file_put_contents() is invoked with an attacker-controlled path that can traverse directories using sequences like ../.

Since the overwritten content is fixed to a PHP docblock, the primary impact is denial of service rather than arbitrary code execution. However, overwriting files such as .htaccess or index.php can render an entire WordPress installation inoperable.

Root Cause

The root cause is a combination of missing security controls in the Perfmatters plugin:

1. Missing Authorization Check: The PMCS::action_handler() method fails to verify that the requesting user has appropriate permissions to perform snippet management operations
2. Missing Nonce Verification: No CSRF protection is implemented, allowing the action to be triggered without a valid WordPress nonce
3. Insufficient Input Sanitization: The $_GET['snippets'][] parameter values are not sanitized to remove path traversal sequences before being used in file operations
4. Unsafe File Operations: The file_put_contents() function is called with user-controllable path data without proper validation

Attack Vector

The attack can be executed remotely over the network by any authenticated WordPress user with at least Subscriber-level privileges. The attacker crafts a malicious request containing path traversal sequences in the snippets[] GET parameter, targeting the bulk action handler endpoint.

When the vulnerable endpoint processes the request, it follows the path traversal sequences to write to files outside the intended snippet directory. Since no nonce verification exists, this attack could potentially be chained with a CSRF vulnerability to trick an authenticated administrator into executing the malicious request, though direct exploitation by low-privileged authenticated users is the primary concern.

The exploitation does not require user interaction beyond authentication and can target critical WordPress files to cause denial of service or potentially modify configuration files to alter site behavior.

Detection Methods for CVE-2026-4351

Indicators of Compromise

• Unexpected modifications to critical WordPress files such as .htaccess, index.php, or wp-config.php
• Web server error logs showing unusual file write operations in WordPress directories
• HTTP request logs containing snippets[] parameters with path traversal sequences (e.g., ../, ..%2f)
• Sudden WordPress site downtime or 500 errors following authenticated user activity

Detection Strategies

• Monitor HTTP access logs for requests to Perfmatters endpoints containing ../ or encoded path traversal sequences in query parameters
• Implement file integrity monitoring on critical WordPress files to detect unauthorized modifications
• Review WordPress user activity logs for Subscriber-level accounts performing unexpected administrative actions
• Deploy Web Application Firewall (WAF) rules to block requests containing path traversal patterns targeting WordPress plugin endpoints

Monitoring Recommendations

• Configure real-time alerts for any modifications to .htaccess, index.php, and wp-config.php files
• Enable verbose logging on web servers to capture full request URIs including query parameters
• Implement baseline monitoring for WordPress file system integrity with automated deviation alerts
• Review authentication logs for unusual patterns of Subscriber account activity

How to Mitigate CVE-2026-4351

Immediate Actions Required

• Update Perfmatters plugin to the latest patched version immediately
• Audit recent file modifications on WordPress installations to identify potential compromise
• Temporarily disable the Perfmatters plugin if an immediate update is not possible
• Review Subscriber-level user accounts and remove unnecessary access

Patch Information

The vulnerability affects Perfmatters plugin versions up to and including 2.5.9. Organizations should update to the latest available version that addresses this vulnerability. Refer to the Perfmatters Change Log for specific version information and patch details. Additional technical information is available in the Wordfence Vulnerability Report.

Workarounds

• Disable the Perfmatters plugin entirely until a patch can be applied
• Implement WAF rules to block requests containing path traversal sequences in the snippets[] parameter
• Restrict Subscriber-level account creation and audit existing low-privileged accounts
• Apply file permission hardening to prevent web server write access to critical WordPress files

# File permission hardening for critical WordPress files
chmod 444 .htaccess
chmod 444 wp-config.php
chmod 444 index.php

# Verify current file permissions
ls -la .htaccess wp-config.php index.php