Skip to content
OpenAdvisories

Vendor

Perfmatters

8 known vulnerabilities.

Products

perfmatters 8
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-4350 Public exploit

    Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter

    The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitizat…

    Perfmatters perfmatters Web / CMS