Das Perfmatters-Plugin für WordPress ist anfällig für das beliebige Überschreiben von Dateien über einen Pfadübersprung in allen Versionen bis einschließlich 2.5.9. Dies liegt daran, dass die Methode `PMCS::action_handler()` die Bulk-Aktionen `activate`/`deactivate` ohne Autorisierungsprüfung oder Nonce-Verifizierung verarbeitet. Die Werte `$_GET['snippets'][]` werden unbereinigt an `Snippet::activate()`/`Snippet::deactivate()` übergeben, die `Snippet::update()` und dann `file_put_contents()` mit dem durchquerten Pfad aufrufen. Di

The impact of this vulnerability is significant. An attacker with Subscriber-level access or higher can leverage the activate/deactivate bulk actions to overwrite critical configuration files, core WordPress files, or even system files. This could lead to remote code execution, denial of service, or the theft of sensitive data. Successful exploitation could grant an attacker complete control over the affected WordPress instance. The lack of proper input sanitization in the PMCS::action_handler() method directly contributes to this risk, allowing attackers to manipulate file paths.

WordPress websites utilizing the Perfmatters plugin, particularly those with Subscriber-level users or higher, are at risk. Shared hosting environments where users have limited control over file permissions are especially vulnerable. Sites with outdated plugin versions or those lacking robust security practices are also at increased risk.

• wordpress / composer / npm:

grep -r "Snippet::update\(" /var/www/html/wp-content/plugins/perfmatters/

• generic web:

curl -I http://your-wordpress-site.com/wp-admin/admin-ajax.php?action=pmcs_action_handler&snippets%5B%5D=../../../../etc/passwd

• wordpress / composer / npm:

wp plugin list --status=all | grep perfmatters

1. 2026-04-10Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-04-10
3. Geändert2026-04-13
4. EPSS aktualisiert2026-04-17

The primary mitigation is to immediately upgrade the Perfmatters plugin to version 2.6.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the nature of path traversal, restricting access to the wp-admin/admin-ajax.php endpoint and carefully reviewing user roles and permissions can reduce the attack surface. Regularly audit plugin code for similar vulnerabilities and enforce strict input validation practices. After upgrading, confirm the fix by attempting to trigger the vulnerable action with a manipulated snippets parameter; the action should fail with an appropriate error message.