What the vulnerability does
01Description
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method processing the bulk action `activate`/`deactivate` handlers without any authorization check or nonce verification. The `$_GET['snippets'][]` values are passed unsanitized to `Snippet::activate()`/`Snippet::deactivate()` which call `Snippet::update()` then `file_put_contents()` with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like `.htaccess` or `index.php`.
Explanation of Vulnerability in Simple Terms
02Summary
Perfmatters versions 2.5.9 and earlier contain a path traversal vulnerability that allows authenticated users to modify or delete files on the server. An attacker with low-level access can bypass file system restrictions and manipulate critical site files, potentially compromising site integrity and availability.
What an attacker can do
03Attacker Capabilities
Modify or delete files on the server outside intended directories.
Potential impact on your site
04Site Impact
Site files can be altered or deleted by authenticated users, risking data loss and site malfunction.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
April 10, 2026
CVE published
April 10, 2026
Record updated
