PT-2026-31849 · WordPress · Perfmatters

Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-4351

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Perfmatters plugin for WordPress versions up to and including 2.5.9

Description The Perfmatters plugin for WordPress is susceptible to arbitrary file overwrite through path traversal. This occurs because the PMCS::action handler() method processes activate/deactivate handlers without proper authorization or nonce verification. The $ GET['snippets'][] values are passed without sanitization to Snippet::activate()/Snippet::deactivate(), which then call Snippet::update() and file put contents() with a potentially traversed path. This allows authenticated attackers with Subscriber-level access or higher to overwrite arbitrary files on the server, potentially leading to denial of service by corrupting critical files like .htaccess or index.php.

Recommendations Update the Perfmatters plugin to a version later than 2.5.9.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4351

Affected Products

Perfmatters

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4351 · Security Note
• https://twitter.com/CVEarity/status/2042876233718075559 · Twitter Post
• https://twitter.com/CVEnew/status/2042561799644680419 · Twitter Post
• https://perfmatters.io/docs/changelog · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c172ab2b-ce1f-4a0d-b31f-b75ff2f03506?source=cve · Note