{"id":"CVE-2026-104801","published":"2026-10-10T07:16:40.560","lastModified":"2026-10-13T13:30:21.620","description":"The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Files/Handler.php#L738","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Support/Helpers.php#L224","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Cart/CartHandler.php#L369","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Order/OrderHandler.php#L287","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3733313/woocommerce-product-addon/trunk/src/WooCommerce/Order/OrderHandler.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650b510f-dc13-4ba4-af68-187f516b3051?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The PPOM plugin has a vulnerability in its rename_files function that allows unauthenticated attackers to delete any file on the server by manipulating file paths, potentially leading to remote code execution if critical files like wp-config.php are removed. This occurs due to insufficient validation of file paths before deletion operations.","exploitability":"Exploitation is straightforward with no authentication required, needing only access to the plugin's file handling endpoint, making it highly suitable for automated attacks.","blast_radius":"The impact could be severe as attackers can delete critical system files including wp-config.php, potentially leading to complete site compromise and remote code execution, while also enabling arbitrary file reads from the uploads directory.","remediation":"Upgrade to version 34.0.11 or later to address this vulnerability.","detection":"Monitor for unusual DELETE requests targeting the plugin's file handling endpoint in web server logs, particularly looking for requests that attempt to delete files outside of expected upload directories with suspicious path traversal patterns.","tags":["file-deletion","rce","wordpress","wp-plugin"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:49:19.307Z"}}