What is the CVSS score of CVE-2026-13251?

CVE-2026-13251 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of Perfmatters are affected by CVE-2026-13251?

Perfmatters WordPress plugin versions 2.6.4 and earlier contain an unauthenticated arbitrary file disclosure vulnerability that allows attackers to read sensitive server files, including database…

How to fix or mitigate CVE-2026-13251?

Within 24 hours: Inventory all WordPress installations using Perfmatters and verify plugin version and configuration status (specifically whether Local Google Fonts is enabled alongside pretty permalinks and RSS feed links). Within 7 days: Disable the Perfmatters plugin entirely, or disable the Local Google Fonts feature to eliminate the attack vector. Within 30 days: Monitor Perfmatters security advisories for patch availability and upgrade immediately to any version >2.6.4 when released by the vendor.

Perfmatters CVE-2026-13251

EUVD-2026-41272 HIGH

Path Traversal (CWE-22)

2026-07-02 Wordfence

GHSA-8456-6w7p-xg3h

WordPress Path Traversal Google Perfmatters

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Unauthenticated remote file read (PR:N, C:H) but three simultaneous non-default configuration prerequisites justify AC:H; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:15 vuln.today

CVE Published

Jul 02, 2026 - 09:32 cve.org

HIGH 7.5

DescriptionCVE.org

The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the Local Google Fonts feature to be enabled (disabled by default), pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings.

AnalysisAI

Arbitrary file disclosure in the Perfmatters WordPress performance plugin (versions ≤ 2.6.4) lets unauthenticated attackers traverse the filesystem via the 's' parameter and read sensitive server files such as wp-config.php. The flaw only surfaces in a specific non-default configuration (Local Google Fonts enabled with pretty permalinks and RSS feed links active), and there is no public exploit identified at time of analysis. Reported by Wordfence with a CVSS of 7.5 (high).

Technical ContextAI

The affected component is Perfmatters, a commercial WordPress optimization plugin, specifically its Local Google Fonts feature implemented in inc/classes/Fonts.php. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): user-supplied input in the 's' request parameter is used to build a filesystem path without sufficient sanitization, so sequences such as ../ allow reading files outside the intended fonts directory. Because the feature registers an endpoint reachable through WordPress rewrite rules (pretty permalinks) and RSS feed handling, the traversal is exposed to unauthenticated HTTP requests. The CPE cpe:2.3:a:perfmatters:perfmatters:*:*:*:*:*:*:*:* covers the plugin across the affected version range.

RemediationAI

Upgrade Perfmatters to the first release after 2.6.4 that addresses this issue - the provided data does not name an exact fixed version, so confirm the patched build against the vendor changelog at https://perfmatters.io/docs/changelog/ before deploying (do not assume a version number). As an immediate compensating control until patched, disable the Local Google Fonts feature in the plugin settings, which fully removes the vulnerable endpoint at the cost of losing local font hosting (fonts will load from Google or fall back per your theme); alternatively, disabling the RSS feed links option in Perfmatters also breaks the required precondition. If neither can be changed, restrict access to the fonts endpoint at the web server/WAF layer and monitor for requests containing traversal sequences (../) in the 's' parameter. Reference the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0082ff-2a33-44e9-b0d0-8b9a404ab648?source=cve) for detection guidance.