Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter
CVE-2026-4350 has a selected CVSS score of 8.1 (high); EIP currently links 1 repository PoC and 1 lab environment.
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.
| Product | Source | Version range | Status |
|---|---|---|---|
PerfmattersBrowse perfmatters / PerfmattersDefault status: unaffected | CVE List | Through 2.5.9.1 | affected |
The artifact contains a Nuclei template that checks for the presence of CVE-2026-4350 by sending a GET request with a path traversal payload to delete wp-config.php. It does not contain exploit code that exercises the vulnerability to achieve file deletion or site takeover; the template only detects the vulnerability.
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Nuclei template for CVE-2026-4350. The README describes the vulnerability and provides commands to run an exploit and a PoC script, but neither script is included in the reviewed text. The Nuclei template contains a standard HTTP request for detecting the vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed files.
The primary artifact is a Nuclei template (nuclei/cve-2026-4350.yaml) that defines a single HTTP request to check for the vulnerability. It does not contain code to exploit the vulnerability (e.g., to delete a file or take over the site); it only detects the presence of the vulnerable endpoint. The README references separate exploit and PoC scripts, but those files are not included in the evidence.
nuclei/cve-2026-4350.yaml:1-10README.md:13-17README.md:11nuclei/cve-2026-4350.yaml:1-10nuclei/cve-2026-4350.yaml:8-10README.md:14README.md:17nuclei/cve-2026-4350.yaml:8-10This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A single-service Docker Compose setup that runs a stock 'wordpress' image and maps container port 80 to host port 8080. The README describes it as the target for CVE-2026-4350, an arbitrary file deletion vulnerability in the Perfmatters WordPress plugin.
vulnerable-setup/docker-compose.yml:1-6README.md:1-4The README explicitly states the environment is for CVE-2026-4350, describes the vulnerability, and provides exploit and PoC commands targeting the WordPress service defined in the Compose file. The Compose file itself is a minimal WordPress service declaration, consistent with a vulnerable target for the described plugin vulnerability.
README.md:1-4README.md:13-16A WordPress service based on the official 'wordpress' image, exposing port 80 on host port 8080. It is intended to host the vulnerable Perfmatters plugin for the CVE-2026-4350 exercise.
vulnerable-setup/docker-compose.yml:3-6README.md:3-4Insufficient evidence
The README claims CVE-2026-4350 is an arbitrary file deletion vulnerability in the Perfmatters plugin, but the packet contains no exploit code, PoC script, plugin files, or any technical detail that would allow verification of the vulnerability. The Compose file only declares a stock WordPress image without the plugin installed, so the association cannot be confirmed or contradicted from the supplied evidence.
README.md:3-4README.md:13-16vulnerable-setup/docker-compose.yml:1-6README.md:9-11README.md:13-16vulnerable-setup/docker-compose.yml:1-6README.md:9-11README.md:13-14README.md:15-16The packet contains only a Compose file and a README. The Compose file is a minimal, non-privileged WordPress service with a port mapping. No exploit code, PoC scripts, or other executable artifacts are included. Without the actual exploit payloads, it is impossible to determine whether the exercise would cause harm beyond the intended lab target. The README disclaimer states 'Educational purposes only,' but no concrete behavior can be assessed.
vulnerable-setup/docker-compose.yml:1-6README.md:18-19This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.