Exploit for CVE-2026-4350

CVE-2026-4350 - Perfmatters WordPress Arbitrary File Deletion...

CVE-2026-4350

creationtimestamp| type| source ---|---|--- 2026-04-03 08:59:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mile7cwvmq2r 2026-04-03 09:15:39+00:00| published-proof-of-concept| Telegram/NBs63VM2nQ9UbXE-D7ue-jsugZ5lhQP4O69jnOBlFC7zlLQ 2026-04-07 22:30:07+00:00| seen|...

CVE-2026-4350

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the PMCS::actionhandler method processing the $GET'delete' parameter without any sanitization, authorization check, or nonce verification...