Perfmatters WordPress Plugin CVE-2026-4350: Brief Summary of Arbitrary File Deletion via Path Traversal

Introduction

An arbitrary file deletion vulnerability in the Perfmatters WordPress plugin puts approximately 200,000 sites at risk of complete takeover through a trivially exploitable path traversal flaw. Any authenticated user with Subscriber-level access can delete critical server files, including wp-config.php, by injecting traversal sequences into a GET parameter that the plugin passes directly to PHP's unlink() function.

Perfmatters, from forgemedia LLC, is a lightweight web performance plugin built to improve Google Core Web Vitals scores and optimize asset loading on WordPress sites. With roughly 200,000 active installations, it holds a meaningful share of the WordPress performance optimization market, and that reach makes this vulnerability relevant across the wider WordPress ecosystem.

Technical Information

CVE-2026-4350 comes from three independent security failures in the PMCS::action_handler() method of the Perfmatters plugin. Any one of them would be a notable weakness. Together, they create a direct path from low-privilege authentication to full site compromise.

Missing Input Sanitization

The action_handler() method reads the $_GET['delete'] parameter and concatenates the raw, unsanitized value directly with the plugin's storage directory path. It then passes the combined string to PHP's unlink() function. With no filtering in place, an attacker can supply path traversal sequences like ../ to escape the intended directory and target any file on the server's filesystem that the web server process has permission to delete.

Missing Authorization Check

The vulnerable code runs no capability check before it processes the delete request. There is no call to current_user_can() or any equivalent authorization gate, so even the lowest authenticated WordPress role (Subscriber) can reach this code path. In effect, the file deletion feature is open to every logged-in user.

Missing Nonce Verification

The endpoint also skips nonce verification, which leaves it open to cross-site request forgery (CSRF). An attacker could craft a malicious link or embed it in a page, and any authenticated WordPress user who visits that page would trigger the file deletion without knowing it.

Attack Flow

Exploitation runs like this:

1. The attacker registers or compromises a WordPress account with at least Subscriber-level access on a site running Perfmatters version 2.5.9.1 or earlier.
2. The attacker crafts an HTTP GET request to the vulnerable endpoint, placing a path traversal payload such as ../../../wp-config.php in the delete parameter.
3. The PMCS::action_handler() method receives this value, concatenates it with the storage directory path, and calls unlink() on the resulting path.
4. The server deletes wp-config.php (or any other targeted file).
5. With wp-config.php gone, WordPress can no longer connect to its database and shows the installation wizard to the next visitor.
6. The attacker visits the site, completes the WordPress installation wizard with their own database credentials, and gains full administrative control.

No special tooling is required, and a single crafted HTTP request is enough to carry out the attack.

Patch Information

forgemedia LLC fixed the vulnerability in Perfmatters version 2.6.0, released on March 25, 2026. The patch addresses all three root causes with layered defenses.

Input Sanitization via normalize_snippet_file_name()

The most critical change adds a new helper method that strips path traversal sequences from any filename before it reaches unlink(). The method applies both basename() (to remove all directory components) and WordPress's sanitize_file_name(), then checks that the result ends with .php and is not index.php:

public static function normalize_snippet_file_name($file_name)
{
    if(!is_scalar($file_name)) {
        return '';
    }
    $file_name = basename(sanitize_file_name((string)$file_name));
    if(empty($file_name) || $file_name === 'index.php' || !preg_match('/\.php$/i', $file_name)) {
        return '';
    }
    return $file_name;
}

basename() alone would neutralize traversal sequences. Pairing it with sanitize_file_name() adds defense in depth, because it also strips shell-special and other dangerous characters. The .php extension check confines operations to code snippet files that Perfmatters itself manages. A companion normalize_snippet_file_names() method handles arrays of filenames for bulk operations and deduplicates them with array_unique().

Authorization (Capability) Check

The patched action_handler() now puts the entire function behind an administrator-level permission check:

public static function action_handler()
{
    if(!empty($_GET['page']) && $_GET['page'] == 'perfmatters') {
        // permissions and network scope check
        if(!current_user_can('manage_options') || !perfmatters_network_access()) {
            return;
        }

current_user_can('manage_options') checks the standard WordPress capability for site administrators, and perfmatters_network_access() adds a second gate for multisite environments. Together they restrict snippet management actions to administrators with the right network-level permissions.

Nonce Verification

The fix now requires a valid nonce on bulk actions through self::verify_action_nonce('pmcs_nonce', 'pmcs-action'), which runs immediately before the bulk action array is processed. The nonce ties each request to a specific authenticated session, preventing CSRF attacks.

Hardened delete() Method

The patch also updates Snippet::delete() to validate its own inputs:

public static function delete($file_names)
{
    $config = PMCS::get_snippet_config();
    foreach(PMCS::normalize_snippet_file_names($file_names) as $file_name) {
        // ... safe deletion logic
    }
}

So even if a code path somehow bypasses the action_handler() gate, delete() still sanitizes its inputs on its own, which is a sound layered-defense pattern.

The vendor changelog describes the fix as "Code snippet security updates to form submission handling."

Affected Systems and Versions

All versions of the Perfmatters WordPress plugin up to and including version 2.5.9.1 are vulnerable. Version 2.6.0 and later contain the fix.

The vulnerability requires:

• An active installation of the Perfmatters plugin (versions up to 2.5.9.1)
• An authenticated WordPress user account with at least Subscriber-level access
• Filesystem permissions that let the web server process delete the targeted files

Approximately 200,000 WordPress sites are running the affected plugin.

Vendor Security History

Perfmatters has a documented history of security vulnerabilities caused by input-handling failures:

Both earlier vulnerabilities were input neutralization failures. CVE-2026-4350 is a significant escalation in severity. XSS requires user interaction and targets the browser, while this arbitrary file deletion gives a direct path to full server-side compromise. The vendor has patched reported vulnerabilities in the past, and it released version 2.6.0 before CVE-2026-4350 was publicly disclosed.

References

• NVD Entry for CVE-2026-4350
• CVE Record: CVE-2026-4350
• Wordfence Threat Intel: CVE-2026-4350
• Wordfence Blog: 200,000 WordPress Sites Affected by Arbitrary File Deletion Vulnerability in Perfmatters
• Perfmatters Changelog
• NVD Entry for CVE-2023-47876
• NVD Entry for CVE-2023-47877
• CISA Known Exploited Vulnerabilities Catalog