Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
The PPOM – Product Addons & Custom Fields for WooCommerce plugin in WordPress is vuln to unauthed arbitrary file deletion -- CVE-2026-104801. Deleting certain files in the WP installation can lead to hijacking the site, or executing code. POC and Lab: https://github.com/Vsimpro/n-day-labs/tree/main/CVE-2026-104801
#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL WOOCOMMERCE PPOM FLAW ENABLES UNAUTHENTICATED SERVER FILE ACCESS AND DELETION October 9, 2026 DISCLOSED BY: Wordfence PRODUCT: PPOM — Product Addons & Custom Fields for WooCommerce CVE: CVE-2026-104801 SEVERITY: Critical — CVSS 9.1 AFFECTED VERSIONS: PPOM 34.0.10 and earlier. Fixed in 34.0.11. IMPACT: Unauthenticated attackers can exploit insufficient path validation in rename_files to move server files into a publicly accessible uploads directory. This enables unauthorized file disclosure and removal from original locations. Deleting wp-config.php may facilitate further site compromise, potentially including code execution. EXPLOITATION STATUS: CONFIRMED VULNERABILITY. Active exploitation remains unverified. Forensic triage: Inspect suspicious POST parameters containing ppom[fields] and [org]. Investigate unexpected files under: /wp-content/uploads/ppom_files/confirmed/ Check for missing configuration files and unauthorized file access. URGENT ACTION: Update PPOM to version 34.0.11 or later. Restrict vulnerable file processing until patched. Investigate exposed files and rotate affected credentials if disclosure occurred. SOURCE: https://www.wordfence.com/threat-intel/vulnerabilities/id/650b510f-dc13-4ba4-af68-187f516b3051?source=cve CONFIDENCE: HIGH — Wordfence vulnerability research and documented remediation. No verified in-the-wild exploitation. #CyberSecurity #ThreatIntel #WordPress #WooCommerce #FileDisclosure #WebSecurity #NØØT