Critical WordPress Plugin Flaw Allows Unauthenticated File Deletion and Remote Code Execution
A critical vulnerability in the PPOM WooCommerce plugin lets attackers delete server files, potentially enabling remote code execution in versions up to 34.0.10.
Key points
- The vulnerability is rated CVSS 9.1, which is classified as critical severity.
- Unauthenticated attackers can delete arbitrary files, including wp-config.php.
- The flaw affects PPOM – Product Addons & Custom Fields for WooCommerce up to version 34.0.10.
The National Vulnerability Database recorded CVE-2026-104801 as a critical vulnerability in the PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress. This flaw allows unauthenticated attackers to delete arbitrary files on the server, creating a pathway for remote code execution.
At a glance
- CVE
- CVE-2026-104801
- Product
- themeisle PPOM – Product Addons & Custom Fields for WooComme
- CVSS
- 9.1 Critical
- Weakness
- path traversal
- Exploited
- No known exploitation
The vulnerability stems from insufficient file path validation in the rename_files function. According to the NVD record, this issue exists in all versions of the plugin up to and including 34.0.10. Attackers can leverage this to delete critical configuration files, such as wp-config.php, which can lead to full server compromise.
Technical Context and Impact
The CVSS score for CVE-2026-104801 is 9.1, placing it in the critical severity range. The underlying weakness is categorized under CWE-22, which refers to path traversal issues. The flaw specifically impacts how the plugin handles file renaming operations on the server side.
When the rename_files function processes a request, it fails to properly validate the file path. This lack of validation allows an attacker to specify paths to files outside the intended directory. Consequently, an unauthenticated user can trigger the deletion of any file the web server process has permission to access.
Who Is Affected
The vulnerability affects websites running the PPOM – Product Addons & Custom Fields for WooCommerce plugin. The plugin is developed by Themeisle. Any WordPress site using this plugin in versions up to 34.0.10 is potentially vulnerable to this attack vector.
The risk is elevated because the attack does not require authentication. An attacker does not need to know a username or password to exploit the flaw. This makes automated scanning and exploitation easier for threat actors targeting large numbers of WordPress installations.
What should you do?
No fix has been confirmed yet in the available source material. Site administrators should monitor for an official update from the vendor. In the meantime, restricting access to the plugin’s endpoints may help mitigate exposure.
What to do and how to stay safe: CVE-2026-104801
- Audit your WordPress plugins to check if you are running PPOM – Product Addons & Custom Fields for WooCommerce version 34.0.10 or earlier.
- Monitor server logs for unusual file deletion or renaming activity that could indicate an exploit attempt.
- Restrict access to the plugin’s API endpoints using a web application firewall or server-level rules if an update is not immediately available.
- Ensure that your wp-config.php and other sensitive files have strict file permissions that limit write access to the web server process.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104801?
The CVSS score is 9.1, which is rated as critical severity.
Which versions of the PPOM plugin are affected?
All versions up to and including 34.0.10 are vulnerable to this flaw.
Can an attacker execute code remotely through this vulnerability?
Yes, deleting files like wp-config.php can easily lead to remote code execution.
