What is the CVSS score of CVE-2026-4350?

CVE-2026-4350 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-4350?

Perfmatters WordPress plugin versions 2.5.9.1 and earlier contain an arbitrary file deletion vulnerability that allows any subscriber-level user to delete critical WordPress files, including…

How to fix or mitigate CVE-2026-4350?

Within 24 hours: Identify all WordPress installations using Perfmatters plugin and document installed versions via wp-admin or file inspection. Within 7 days: Disable or immediately remove Perfmatters plugin versions ≤2.5.9.1; if functionality is required, evaluate alternative plugins and restrict subscriber role assignments to trusted users only. Within 30 days: Audit user account access logs for any subscriber-level deletions of wp-config.php or other critical files; implement Web Application Firewall (WAF) rules to block path traversal patterns in Perfmatters requests; establish monitoring for unauthorized file deletion attempts.

PHP CVE-2026-4350

EUVD-2026-18609 HIGH

Path Traversal (CWE-22)

2026-04-03 Wordfence

GHSA-7hmf-75fm-xr24

WordPress PHP Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 03, 2026 - 07:45 euvd

EUVD-2026-18609

Analysis Generated

Apr 03, 2026 - 07:45 vuln.today

CVE Published

Apr 03, 2026 - 07:41 nvd

HIGH 8.1

DescriptionCVE.org

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the PMCS::action_handler() method processing the $_GET['delete'] parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to unlink(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using ../ path traversal sequences, including wp-config.php which would force WordPress into the installation wizard and allow full site takeover.

AnalysisAI

Arbitrary file deletion in Perfmatters WordPress plugin (≤2.5.9.1) allows authenticated attackers with Subscriber-level access to delete critical files including wp-config.php via path traversal, enabling full site takeover. The vulnerability stems from unsanitized GET parameter processing in PMCS::action_handler() without authentication or nonce checks. CVSS 8.1 reflects network-accessible attack requiring only low-privilege authentication with high integrity and availability impact. No public exploit identified at time of analysis, though the attack vector is straightforward given the lack of input validation.

Technical ContextAI

This vulnerability affects the Perfmatters performance optimization plugin for WordPress (CPE: cpe:2.3:a:perfmatters:perfmatters). The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal). The PMCS::action_handler() method accepts user-controlled input from the $_GET['delete'] parameter and directly concatenates it with a storage directory path before passing to PHP's unlink() function without sanitization, authorization verification, or WordPress nonce validation. This classic path traversal vulnerability allows attackers to escape the intended directory using '../' sequences to traverse the filesystem hierarchy. The severity is amplified by WordPress's role-based access control where even the lowest authenticated role (Subscriber) can exploit this flaw, and the ability to delete wp-config.php forces WordPress into installation mode, granting complete administrative access to attackers.

RemediationAI

Immediate upgrade to Perfmatters version 2.5.9.2 or later is required, as versions through 2.5.9.1 remain vulnerable to arbitrary file deletion. Consult the official Perfmatters changelog at https://perfmatters.io/docs/changelog/ for the patched release. Until patching is complete, administrators should disable the Perfmatters plugin entirely to eliminate the attack surface. Additionally, restrict WordPress user registration or carefully audit existing Subscriber-level accounts, as any authenticated user can exploit this vulnerability. Implement file integrity monitoring to detect unauthorized deletion of critical files like wp-config.php. Review web server logs for suspicious GET requests containing '../' path traversal sequences targeting the vulnerable endpoint. After upgrading, verify that PMCS::action_handler() now includes proper input sanitization, nonce verification, and capability checks before processing file deletion requests. Detailed vulnerability analysis is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/58b9dab8-8539-4b53-b08d-f6ee3e1e744c?source=cve.