Is CVE-2026-4350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4350 being exploited in the wild.

How severe is CVE-2026-4350?

High severity, with a CVSS score of 8.1, published 3 April 2026.

Which products and versions are affected?

Perfmatters up to, and including, 2.5.9.1.

Is there a fix for CVE-2026-4350?

A patch was published on 2026-03-25: Version 2.6.0 released with minimum PHP requirement increase and library updates; subsequent security hardening followed in 2.6.4 and 2.6.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4350 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4350?

Check whether you run Perfmatters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4350: Perfmatters arbitrary file deletion via path traversal in PMCS::action_handler

CVE-2026-4350 · Severity: high · CVSS 8.1 · Published 2026-04-03

Perfmatters, a WordPress plugin used for site speed optimization, contains a security flaw that allows users with basic account access (such as subscribers) to delete files from the web server. By deleting critical system files like the WordPress configuration file, an attacker can force the website into a setup state and take full control of the site. This could lead to a complete site takeover, data loss, and service disruption.

Technologies: Perfmatters. Vendors: Perfmatters.

Quick answers

Is CVE-2026-4350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4350 being exploited in the wild.
How severe is CVE-2026-4350?: High severity, with a CVSS score of 8.1, published 3 April 2026.
Which products and versions are affected?: Perfmatters up to, and including, 2.5.9.1.
Is there a fix for CVE-2026-4350?: A patch was published on 2026-03-25: Version 2.6.0 released with minimum PHP requirement increase and library updates; subsequent security hardening followed in 2.6.4 and 2.6.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4350 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4350?: Check whether you run Perfmatters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the `PMCS::action_handler()` method of the Perfmatters plugin due to insufficient sanitization of the `delete` GET parameter. The application fails to perform authorization checks or nonce verification before concatenating the user-supplied filename with the storage directory path and passing it to the PHP `unlink()` function. Authenticated attackers with Subscriber-level permissions or higher can use `../` sequences to delete arbitrary files on the server. A common exploit path involves deleting `wp-config.php`, which triggers the WordPress installation wizard and allows the attacker to reconfigure the site and gain administrative control. The issue is addressed in versions following 2.5.9.1.

Affected products

perfmatters Perfmatters up to, and including, 2.5.9.1

Timeline

2026-03-25: patched: Version 2.6.0 released with minimum PHP requirement increase and library updates; subsequent security hardening followed in 2.6.4 and 2.6.5.
2026-04-03: advisory: Initial disclosure by Wordfence and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.