PPOM WooCommerce Path Traversal Flaw Exposes wp-config.php for Deletion and Public Data Read Access

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a critical security flaw allowing unauthenticated arbitrary file deletion. National Vulnerability Database records classify CVE-2026-104801 as critical with a CVSS score of 9.1. The vulnerability stems from inadequate file path validation within the plugin’s rename_files function. This defect affects all plugin versions up to and including 34.0.10, exposing thousands of e-commerce sites to severe risk.

Root cause

The core issue lies in the rename_files function, which fails to properly validate file paths before processing deletion requests. This insufficient validation maps directly to CWE-22, or Improper Limitation of a Pathname to a Restricted Directory. Because the function does not restrict operations to a safe directory, attackers can traverse the file system. This allows them to target any file on the server that the web process has permission to access, bypassing intended security boundaries.

Attack path

An unauthenticated attacker exploits this flaw by sending crafted requests that specify arbitrary file paths for deletion. When the rename_files function processes these requests, it deletes the targeted file from its original location. Simultaneously, the plugin moves the deleted file byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory. This mechanism effectively converts a deletion operation into an arbitrary file read vulnerability.

Affected versions

• PPOM – Product Addons & Custom Fields for WooCommerce version 34.0.10
• All earlier versions of the PPOM plugin
• WordPress installations using any version of the plugin up to 34.0.10

Mitigation

• Identify all WordPress sites using the PPOM plugin immediately.
• Check plugin versions to determine if they are at or below 34.0.10.
• Monitor server logs for unusual file access or deletion patterns.
• Restrict public access to the wp-content/uploads/ppom_files/confirmed/ directory if possible.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: PPOM

• Audit your WordPress installations for the presence of the PPOM plugin.
• Verify the installed version against the affected range up to 34.0.10.
• Review server access logs for requests targeting the rename_files function.
• Once the vendor provides an update, apply it immediately to patch the flaw.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104801?

The National Vulnerability Database rates CVE-2026-104801 as critical with a CVSS score of 9.1.

How does this vulnerability lead to remote code execution?

Attackers can delete critical configuration files such as wp-config.php. Deleting these files can disrupt site integrity or allow attackers to inject malicious code, leading to remote code execution.

Which specific function is vulnerable in the PPOM plugin?

The rename_files function contains insufficient file path validation, enabling the arbitrary file deletion and read vulnerabilities.