PPOM Plugin Path Traversal Bug Lets Attackers Delete Files and Run Code on WordPress Sites
A critical flaw in the PPOM plugin for WordPress lets attackers delete server files and execute code without logging in, affecting versions up to 34.0.10.
Key points
- The vulnerability is tracked as CVE-2026-104801 with a CVSS score of 9.1, classified as critical by the National Vulnerability Database.
- Insufficient file path validation in the rename_files function enables arbitrary file deletion on the server by unauthenticated attackers.
- The bug also results in arbitrary file read access, as deleted files are moved to a publicly accessible directory on the web server.
The PPOM – Product Addons & Custom Fields for WooCommerce plugin contains a critical security flaw that allows unauthenticated attackers to delete arbitrary files on a WordPress server. According to the National Vulnerability Database, this issue, identified as CVE-2026-104801, stems from insufficient file path validation within the plugin’s rename_files function. The vulnerability affects all versions of the plugin up to and including 34.0.10, exposing sites that have not yet updated to a patched version.
The risk
The core technical issue is a path traversal vulnerability, categorized under CWE-22, which permits attackers to manipulate file paths during the renaming process. An unauthenticated attacker can exploit this flaw to delete any file on the server that the web server process has permission to access. Deleting critical configuration files, such as wp-config.php, can disrupt site functionality and potentially lead to remote code execution if the attacker can replace the deleted file with malicious code.
Furthermore, the deletion process moves the targeted file byte-identically into the wp-content/uploads/ppom_files/confirmed/ directory. Because this directory is publicly accessible via the web, the attack effectively grants arbitrary file read access to any web-readable file on the server. This means an attacker can view sensitive data, including database credentials and private keys, simply by triggering the deletion of those files. The combination of file deletion and exposure creates a severe risk of full site compromise.
Who is exposed
Any WordPress site running the PPOM – Product Addons & Custom Fields for WooCommerce plugin developed by ThemeIsle is exposed to this threat. The vulnerability affects all plugin versions up to and including 34.0.10. Small-business owners using WooCommerce for e-commerce often rely on such plugins to customize product offerings, making them frequent targets for automated scanning bots that look for known vulnerabilities in popular extensions.
Sites that have not updated the plugin since its release or have deferred updates due to compatibility concerns remain vulnerable. The National Vulnerability Database records indicate that the flaw exists in the codebase of these specific versions, requiring immediate attention from site administrators who manage online stores dependent on this addon functionality.
Cost and compliance
The National Vulnerability Database assigns a CVSS score of 9.1 to CVE-2026-104801, rating the severity as critical. This high score reflects the ease of exploitation by unauthenticated attackers and the potential for complete server compromise. While the source material does not detail specific financial losses or regulatory fines, the ability to read sensitive configuration files could violate data protection regulations if customer or payment data is exposed through the publicly accessible upload directory.
What to watch
Monitor server logs for unusual file access patterns or requests targeting the ppom_files directory. Watch for sudden site outages or configuration errors that may indicate a successful file deletion attack. Administrators should verify that their plugin versions are below 34.0.10 and prepare for an update as soon as the vendor releases a fix.
What to do and how to stay safe: PPOM
- Check your WordPress admin dashboard to confirm the installed version of the PPOM – Product Addons & Custom Fields for WooCommerce plugin.
- Restrict directory permissions on the wp-content/uploads folder to limit public access if an immediate plugin update is not possible.
- Monitor server access logs for suspicious requests targeting the rename_files function or the confirmed upload directory.
- Once the vendor provides an update, apply the patch immediately to close the path traversal vulnerability.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-104801?
It is a critical vulnerability in the PPOM WooCommerce plugin that allows unauthenticated attackers to delete arbitrary files and read sensitive data through path traversal.
Which plugin versions are affected?
All versions of the PPOM – Product Addons & Custom Fields for WooCommerce plugin up to and including version 34.0.10 are vulnerable.
Can an attacker execute code on my server?
Yes, deleting critical files like wp-config.php can lead to remote code execution, especially if the attacker can manipulate the server state after the deletion.
