CVE-2026-4351

The Perfmatters WordPress plugin versions up to 2.5.9 contains a critical arbitrary file overwrite vulnerability resulting from inadequate input validation and authorization controls in the bulk action handler. Unauthenticated path traversal via the snippets parameter allows authenticated users with Subscriber-level privileges to write malicious content to arbitrary server locations, including system-critical files. The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH) with a network-based attack vector requiring only low complexity and user authentication. The attack has significant integrity and availability impact, as adversaries can corrupt or replace essential files such as .htaccess or index.php, resulting in service disruption or unauthorized system modification. The flaw stems from the absence of nonce verification and proper authorization checks in the action_handler method. Exploitation status indicators suggest limited active threat at present. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog, and the EPSS probability score of 0.061 percent indicates relatively low current exploitation likelihood. Community attention remains minimal with the vulnerability classified as inactive on relevant threat tracking systems. Organizations should prioritize patching to versions beyond 2.5.9, though immediate emergency response measures are not currently warranted based on available threat intelligence.