CVE-2026-4351: Path Traversal in Perfmatters WordPress Plugin

The vulnerability lies within the PMCS::actionhandler() method, which processes activate and deactivate bulk actions without proper authorization checks or nonce verification. Malicious actors, possessing Subscriber-level access or higher, can exploit this by manipulating the $GET['snippets'][] parameter. This parameter is then passed unsanitized to Snippet::activate()/Snippet::deactivate(), ultimately calling Snippet::update() and fileputcontents(). The lack of sanitization allows attackers to craft requests that include path traversal sequences, enabling them to overwrite critical system files or plugin configurations. Successful exploitation could lead to remote code execution, denial of service, or data breaches.

1. Reserved2026-03-17
2. Published2026-04-10
3. Modified2026-04-13
4. EPSS updated2026-04-17

The primary mitigation for CVE-2026-4351 is to immediately upgrade the Perfmatters plugin to version 2.6.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting file access permissions for the WordPress uploads directory. Additionally, implement a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal sequences (e.g., ../). Regularly review plugin access permissions and ensure that only necessary roles have access to sensitive functions. After upgrading, verify the fix by attempting to access a file outside the intended directory via the vulnerable endpoint and confirming that access is denied.