📄 Description (English)
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.
🤖 AI Executive Summary
CVE-2026-4350 is a critical path traversal vulnerability in the Perfmatters WordPress plugin (versions ≤2.5.9.1) that allows authenticated Subscriber-level users to delete arbitrary files on the server, including wp-config.php. This vulnerability lacks proper input sanitization, authorization checks, and nonce verification, enabling attackers to trigger a WordPress installation wizard and achieve complete site takeover. With no patch currently available and no exploit publicly disclosed, organizations must immediately implement compensating controls.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 26, 2026 08:17
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability poses significant risk to Saudi organizations heavily reliant on WordPress for web presence, particularly: (1) Banking sector (SAMA-regulated institutions) using WordPress for customer portals and informational sites; (2) Government agencies and municipalities using WordPress for public services; (3) Healthcare providers (MOH-regulated) using WordPress for patient information systems; (4) E-commerce and retail sectors; (5) Telecommunications companies (STC, Mobily) using WordPress for customer-facing platforms. The ability to delete wp-config.php and force installation wizard access could lead to complete compromise of sensitive data, regulatory non-compliance, and operational disruption. Saudi organizations must prioritize remediation given the prevalence of WordPress in the Kingdom's digital infrastructure.
🏢 Affected Saudi Sectors
Banking and Financial Services (SAMA-regulated)
Government and Public Administration
Healthcare (MOH-regulated)
E-commerce and Retail
Telecommunications (STC, Mobily, Zain)
Energy and Utilities
Education
Media and Publishing
Hospitality and Tourism
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
8.7
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Audit all WordPress installations in your environment to identify if Perfmatters plugin is installed and determine current version
2. If Perfmatters ≤2.5.9.1 is installed, immediately disable the plugin via wp-cli: wp plugin deactivate perfmatters
3. Restrict database user permissions to read-only where possible to limit file deletion impact
4. Implement Web Application Firewall (WAF) rules to block requests containing '../' sequences in GET parameters
5. Enable WordPress security logging and monitor for suspicious file deletion attempts
COMPENSATING CONTROLS (until patch available):
6. Implement strict file system permissions: chmod 644 wp-config.php and chmod 755 wp-content/
7. Create immutable backups of wp-config.php using: chattr +i wp-config.php
8. Restrict Subscriber-level user creation and audit existing Subscriber accounts
9. Implement IP whitelisting for WordPress admin access
10. Deploy ModSecurity rules to detect path traversal patterns in HTTP requests
11. Configure automated file integrity monitoring (AIDE/Tripwire) for critical WordPress files
12. Implement Web Application Firewall rules: Block requests with pattern '(\.\./)' in query strings
DETECTION RULES:
- Monitor access logs for GET requests containing 'delete=' parameter with '../' sequences
- Alert on any unlink() or file deletion operations initiated by Subscriber-level users
- Track wp-config.php access and modification attempts
- Monitor for WordPress installation wizard initialization (wp-admin/setup-config.php access)
PATCHING STRATEGY:
- Contact Perfmatters support for patch timeline
- Prepare for immediate plugin update once patch is released
- Consider alternative WordPress optimization plugins as contingency
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. قم بتدقيق جميع تثبيتات WordPress في بيئتك لتحديد ما إذا كان مكون Perfmatters مثبتاً وتحديد الإصدار الحالي
2. إذا كان Perfmatters ≤2.5.9.1 مثبتاً، قم بتعطيل المكون فوراً عبر wp-cli: wp plugin deactivate perfmatters
3. قيّد أذونات مستخدم قاعدة البيانات للقراءة فقط حيث أمكن لتحديد تأثير حذف الملفات
4. تنفيذ قواعد جدار حماية تطبيقات الويب (WAF) لحجب الطلبات التي تحتوي على تسلسلات '../'
5. تفعيل تسجيل أمان WordPress ومراقبة محاولات حذف الملفات المريبة
الضوابط التعويضية (حتى توفر التصحيح):
6. تنفيذ أذونات نظام الملفات الصارمة: chmod 644 wp-config.php و chmod 755 wp-content/
7. إنشاء نسخ احتياطية ثابتة من wp-config.php باستخدام: chattr +i wp-config.php
8. تقييد إنشاء حسابات المستخدمين على مستوى المشترك وتدقيق الحسابات الموجودة
9. تنفيذ القائمة البيضاء للعناوين IP لوصول WordPress admin
10. نشر قواعد ModSecurity للكشف عن أنماط عبور المسارات في طلبات HTTP
11. تكوين مراقبة سلامة الملفات المؤتمتة (AIDE/Tripwire) للملفات الحرجة في WordPress
12. تنفيذ قواعد جدار حماية تطبيقات الويب: حجب الطلبات بنمط '(\.\./)' في سلاسل الاستعلام
قواعد الكشف:
- مراقبة سجلات الوصول للطلبات GET التي تحتوي على معامل 'delete=' مع تسلسلات '../'
- تنبيه على أي عمليات unlink() أو حذف ملفات يتم بدؤها بواسطة مستخدمي مستوى المشترك
- تتبع وصول wp-config.php ومحاولات التعديل
- مراقبة تهيئة معالج تثبيت WordPress (وصول wp-admin/setup-config.php)
استراتيجية التصحيح:
- اتصل بدعم Perfmatters للحصول على جدول زمني للتصحيح
- التحضير للتحديث الفوري للمكون بمجرد إصدار التصحيح
- النظر في مكونات تحسين WordPress البديلة كخطة احتياطية
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Information Security Policies and Procedures
ECC 2024 A.6.1.1 - Access Control Policy
ECC 2024 A.8.2.1 - User Access Management
ECC 2024 A.12.2.1 - Restrictions on Software Installation
ECC 2024 A.12.4.1 - Event Logging
ECC 2024 A.12.4.3 - Administrator and Operator Logs
ECC 2024 A.14.2.1 - Secure Development Policy
🔵 SAMA CSF
SAMA CSF ID.AM-2 - Software Inventory and Management
SAMA CSF PR.AC-1 - Access Control and User Rights Management
SAMA CSF PR.AC-4 - Access Rights and Privileges
SAMA CSF PR.PT-1 - Security Awareness and Training
SAMA CSF DE.AE-1 - Audit and Accountability
SAMA CSF DE.CM-1 - System Monitoring and Anomaly Detection
SAMA CSF RS.MI-2 - Incident Response and Recovery
🟡 ISO 27001:2022
ISO 27001:2022 A.5.1 - Policies for Information Security
ISO 27001:2022 A.6.1 - Screening
ISO 27001:2022 A.8.1 - User Endpoint Devices
ISO 27001:2022 A.8.2 - Privileged Access Rights
ISO 27001:2022 A.8.3 - Information Access Restriction
ISO 27001:2022 A.12.4 - Logging
ISO 27001:2022 A.14.2 - Secure Development Policy
🟣 PCI DSS v4.0.1
PCI DSS 1.1 - Firewall Configuration Standards
PCI DSS 2.1 - Default Passwords and Security Parameters
PCI DSS 6.2 - Security Patches and Updates
PCI DSS 7.1 - Access Control Implementation
PCI DSS 10.2 - User Access Logging
PCI DSS 11.3 - Penetration Testing