CVE-2026-104801

Summary

The PPOM plugin has a vulnerability in its rename_files function that allows unauthenticated attackers to delete any file on the server by manipulating file paths, potentially leading to remote code execution if critical files like wp-config.php are removed. This occurs due to insufficient validation of file paths before deletion operations.

Exploitability

Exploitation is straightforward with no authentication required, needing only access to the plugin's file handling endpoint, making it highly suitable for automated attacks.

Blast radius

The impact could be severe as attackers can delete critical system files including wp-config.php, potentially leading to complete site compromise and remote code execution, while also enabling arbitrary file reads from the uploads directory.

Detection

Monitor for unusual DELETE requests targeting the plugin's file handling endpoint in web server logs, particularly looking for requests that attempt to delete files outside of expected upload directories with suspicious path traversal patterns.

Prioritized remediation

Upgrade to version 34.0.11 or later to address this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.