Unauthenticated Attackers Can Delete Files and Read Data via PPOM Plugin Flaw

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. According to the National Vulnerability Database, this flaw, tracked as CVE-2026-104801, affects all plugin versions up to and including 34.0.10. The issue stems from insufficient file path validation within the plugin’s codebase.

How does the vulnerability work?

The vulnerability exists in the rename_files function, which fails to properly validate file paths. This lack of validation allows an attacker to specify paths to files outside the intended scope. By exploiting this path traversal weakness, identified as CWE-22, an unauthenticated user can trigger the deletion of any file on the server that the web process has permission to access.

What are the specific risks?

Deleting specific configuration files, such as wp-config.php, can lead to remote code execution. The NVD record notes that removing the right file easily enables this outcome. Additionally, the plugin moves the deleted file into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory. This behavior results in arbitrary file read access for any web-readable file on the server, exposing sensitive data before it is fully removed from the system.

Which software versions are affected?

The flaw impacts the PPOM – Product Addons & Custom Fields for WooCommerce plugin developed by themeisle. According to the source material, all versions up to and including 34.0.10 are vulnerable. Sites running older versions of this plugin are also at risk. The severity is rated as critical with a CVSS score of 9.1, indicating a high likelihood of successful exploitation by remote attackers without authentication.

What is the current status?

No patch or fix has been confirmed in the provided source material. Security teams should assume that versions up to 34.0.10 remain vulnerable until an official update is released and verified. The absence of a confirmed fix means that exposed sites remain susceptible to file deletion and data exposure. Monitoring vendor announcements for a remediation update is essential for maintaining site integrity.

What to do and how to stay safe: PPOM

• Review installed WordPress plugins to identify if PPOM version 34.0.10 or earlier is present.
• Monitor server logs for unusual file access or deletion attempts targeting configuration files.
• Restrict access to the wp-content/uploads/ppom_files/confirmed/ directory if possible.
• Prepare to apply an update once the vendor provides a confirmed security fix.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104801?

The CVSS score is 9.1, which is rated as critical.

Does this vulnerability require authentication?

No, the vulnerability allows unauthenticated attackers to exploit the flaw.

Which function contains the insufficient validation?

The rename_files function contains the insufficient file path validation.