CVE-2026-4351

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the PMCS::action_handler() method processing the bulk action activate/deactivate handlers without any authorization check or nonce verification. The $_GET['snippets'][] values are passed unsanitized to Snippet::activate()/Snippet::deactivate() which call Snippet::update() then file_put_contents() with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like .htaccess or index.php.

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the PMCS::action_handler() method processing the bulk action activate/deactivate handlers without any authorization check or nonce verification. The $_GET['snippets'][] values are passed unsanitized to Snippet::activate()/Snippet::deactivate() which call Snippet::update() then file_put_contents() with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like .htaccess or index.php.

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the PMCS::action_handler() method processing the bulk action activate/deactivate handlers without any authorization check or nonce verification. The $_GET['snippets'][] values are passed unsanitized to Snippet::activate()/Snippet::deactivate() which call Snippet::update() then file_put_contents() with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like .htaccess or index.php.

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the PMCS::action_handler() method processing the bulk action activate/deactivate handlers without any authorization check or nonce verification. The $_GET['snippets'][] values are passed unsanitized to Snippet::activate()/Snippet::deactivate() which call Snippet::update() then file_put_contents() with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like .htaccess or index.php.