Executive brief
Perfmatters is a WordPress plugin designed to improve website performance. A security vulnerability in the plugin allows users with basic account access (such as subscribers) to overwrite critical system files on the web server. This could lead to a complete website outage or a denial-of-service condition by corrupting essential files like the site's configuration or main index files.
Technical details
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in the PMCS::action_handler() method. This component processes 'activate' and 'deactivate' bulk actions without performing necessary authorization checks or nonce verification. The $_GET['snippets'] array values are passed unsanitized to Snippet::activate() or Snippet::deactivate(), which eventually trigger file_put_contents() using a path constructed from the user input. Authenticated attackers with Subscriber-level permissions or higher can exploit this to overwrite arbitrary files on the server with fixed PHP docblock content. This can result in a denial-of-service (DoS) by corrupting critical files such as .htaccess or index.php. The issue was addressed in version 2.6.0.
Affected products
- perfmatters.io Perfmatters <= 2.5.9
Timeline
- 2026-03-25: patched: Security updates to form submission handling in version 2.6.0
- 2026-04-09: disclosed: Vulnerability reported by Wordfence
- 2026-04-10: advisory