CVE-2026-4351

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method processing the bulk action `activate`/`deactivate` handlers without any authorization check or nonce verification. The `$_GET['snippets'][]` values are passed unsanitized to `Snippet::activate()`/`Snippet::deactivate()` which call `Snippet::update()` then `file_put_contents()` with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like `.htaccess` or `index.php`.

• CWE-22

• https://perfmatters.io/docs/changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c172ab2b-ce1f-4a0d-b31f-b75ff2f03506?source=cve

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43502In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-43503In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-43504An issue was discovered in Prosody before 0.12.6 and 1.0.0 t…6.5
• CVE-2026-43505An issue was discovered in Prosody before 0.12.6 and 1.0.0 t…6.5
• CVE-2026-43506An issue was discovered in Prosody before 0.12.6 and 1.0.0 t…7.5
• CVE-2026-43507An issue was discovered in Prosody before 0.12.6 and 1.0.0 t…7.5
• CVE-2026-43510manage.get.gov is the .gov TLD registrar maintained by CISA.…5.9
• CVE-2026-43512DEPRECATED: Authentication Bypass Issues vulnerability in di…9.8
• CVE-2026-43513Improper Handling of Case Sensitivity vulnerability in LockO…7.5
• CVE-2026-43514Observable Timing Discrepancy vulnerability when comparing A…3.7
• CVE-2026-43515Improper Authorization vulnerability when multiple method co…9.1
• CVE-2026-4352The JetEngine plugin for WordPress is vulnerable to SQL Inje…7.5