Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)

Metadata

Affected Target

Summary

CVE-2026-4350 is a path traversal vulnerability in the Perfmatters WordPress performance plugin that allows arbitrary file deletion. The plugin’s perfmatters_delete AJAX action (reachable via wp-admin/admin-ajax.php) takes a delete parameter and passes it to a file-deletion routine without sanitizing directory-traversal sequences, allowing an attacker to delete arbitrary files on the server filesystem, including core WordPress files such as wp-config.php.

Vulnerability Details

Root Cause

The perfmatters_delete AJAX handler reads the delete request parameter ($_GET['delete']) directly and uses it to build a filesystem path for a delete operation, with no path-traversal sanitization or containment to an expected plugin-owned directory. Supplying a relative path such as ../../../../wp-config.php escapes the intended directory and targets arbitrary files relative to the WordPress webroot.

Attack Vector

1. An attacker sends an HTTP GET request to wp-admin/admin-ajax.php?action=perfmatters_delete&delete=<traversal-path> on a target running a vulnerable Perfmatters version.
2. The delete parameter is not validated/sanitized, so a traversal sequence like ../../../../wp-config.php resolves outside the plugin’s intended data directory.
3. The plugin deletes the resolved file. Deleting wp-config.php removes the site’s database credentials/config, breaking the site (denial of service) and potentially enabling further compromise if the attacker can subsequently trigger WordPress’s setup wizard to supply their own database configuration (a known post-exploitation pattern for this class of bug, though not demonstrated in this PoC).

Impact

Unauthenticated arbitrary file deletion leading to denial of service (site outage via deletion of wp-config.php, .htaccess, or other critical files) and potential full site takeover if an attacker can re-run WordPress installation/setup against a database they control after deleting the configuration file.

Environment / Lab Setup

Target: WordPress site with Perfmatters plugin <= 2.5.9.1 installed and active.
Lab: vulnerable-setup/docker-compose.yml brings up a stock `wordpress` Docker
     image on port 8080 (the Perfmatters plugin itself must be installed
     separately into the WordPress instance to reproduce the vulnerable
     configuration).

Run lab:
  cd vulnerable-setup && docker compose up -d

Proof of Concept

PoC Script

See exploit/exploit.py, poc/poc.sh, and nuclei/cve-2026-4350.yaml in this folder.

1
2
3
4
5

python3 exploit/exploit.py http://target

bash poc/poc.sh http://target

nuclei -t nuclei/cve-2026-4350.yaml -u http://target

Running the exploit sends unauthenticated requests to wp-admin/admin-ajax.php?action=perfmatters_delete with traversal payloads targeting wp-config.php and .htaccess; a vulnerable target returns an HTTP success status and the targeted file is removed from disk.

Detection & Indicators of Compromise

Web server / access log signature:
  GET /wp-admin/admin-ajax.php?action=perfmatters_delete&delete=../../../../wp-config.php
  GET /wp-admin/admin-ajax.php?action=perfmatters_delete&delete=../../../../.htaccess

Signs of compromise:

• Unexpected disappearance of wp-config.php, .htaccess, or other core files, followed by site errors (“Error establishing a database connection” or similar).
• Access log entries containing action=perfmatters_delete combined with ../ traversal sequences in the delete parameter.
• WordPress setup/installation wizard (wp-admin/setup-config.php) being accessed shortly after a file-deletion event (potential follow-on takeover attempt).

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/whyiamsobusy/CVE-2026-4350 on 2026-07-05.