Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method processing the bulk action `activate`/`deactivate` handlers without any authorization check or nonce verification. The `$_GET['snippets'][]` values are passed unsanitized to `Snippet::activate()`/`Snippet::deactivate()` which call `Snippet::update()` then `file_put_contents()` with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like `.htaccess` or `index.php`.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-10 | 1 | Disclosure1 |
| 2026-04-11 | 1 | Disclosure1 |
| 2026-04-19 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-4351-perfmatters-version-2-5-9-high-vulnerability-proof-of-concept CVE-2026-4351 #WordPress plugin #vulnerability perfmatters #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE‑2026‑4351 targeting PerfMatters 2.5.9 is shared via a link, but no exploit code, active use, patch, or detailed technical data are provided.
⚡ New CVE Alert: CVE-2026-4351 📊 Severity: 8.1 🚨 Risk Level: High 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4351 #CVE-2026-4351 #CVE #High #Wordpress #CyberSecurity #InfoSec https://t.co/Mpqo6qVj25
Post summary
The tweet announces a new CVE (CVE-2026-4351) affecting WordPress with a high severity score and provides a link to the NVD entry, but it offers no deeper technical, exploit, or patch information.
CVE-2026-4351 The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS:… https://www.cve.org/CVERecord?id=CVE-2026-4351
Post summary
A new CVE-2026‑4351 vulnerability affecting the Perfmatters WordPress plugin has been disclosed, permitting arbitrary file overwrites via path traversal up to version 2.5.9.