CVE-2026-104801 in PPOM Plugin
Summary
by MITRE • 10/10/2026
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in PPOM – Product Addons & Custom Fields for WooCommerce affects all versions up to and including 34.0.10. This plugin is a widely used extension for WordPress that allows merchants to add custom fields and product addons to their online stores. The core issue lies within the rename_files function, which handles file operations during the processing of uploaded files. Due to insufficient validation of user-supplied input regarding file paths, an attacker can manipulate the destination path specified in this function. This lack of rigorous sanitization allows for a Path Traversal attack vector, where the application fails to properly restrict access to directories outside the intended scope.
The technical flaw enables unauthenticated attackers to perform arbitrary file deletion on the server hosting the WordPress installation. By exploiting the insufficient validation in the rename_files routine, an attacker can specify target files located anywhere within the server's filesystem that are accessible by the web server process. The operational impact of this vulnerability is severe because it directly compromises the integrity and availability of critical system files. If a vital configuration file such as wp-config.php is deleted, the WordPress application will fail to connect to its database, resulting in a complete denial of service for legitimate users. Furthermore, the deletion of other essential PHP or script files can disrupt plugin functionality or core features, leading to significant operational downtime and potential data loss if backups are not readily available.
Beyond file deletion, this vulnerability also facilitates arbitrary file read operations. The mechanism described indicates that relocated files are moved byte-identically into a publicly accessible directory named wp-content/uploads/ppom_files/confirmed/. This behavior means that any web-readable file on the server can be copied to this public location through manipulation of the source path in the rename operation. Consequently, an attacker can extract sensitive information such as database credentials stored in configuration files, private keys, or other confidential data residing within the server's directory structure. The combination of arbitrary file deletion and arbitrary file read creates a powerful attack chain that significantly lowers the barrier for achieving Remote Code Execution (RCE).
The potential for remote code execution arises when critical security controls are removed via file deletion. For instance, deleting wp-config.php not only causes service disruption but can also be part of a broader exploitation strategy where subsequent steps leverage other vulnerabilities or misconfigurations to gain shell access. Additionally, if the attacker can write malicious files into executable directories through related flaws in the same plugin family, the ability to read and delete existing security scripts further aids in bypassing defenses. This scenario aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application does not adequately verify that user inputs are confined to expected locations. It also relates to CWE-732: Incorrect Permission Assignment for Critical Resource, given the exposure of sensitive files in a public directory.
From an ATT&CK perspective, this vulnerability supports techniques under the Initial Access and Execution tactics. The ability to read arbitrary files corresponds to T1083: File and Directory Discovery, allowing attackers to map out the system environment. The deletion of critical files aligns with T1485: Data Destruction, impacting availability. If the file reading leads to credential theft, it facilitates T1078: Valid Accounts or T1528: Steal Application Access Tokens. Finally, if these actions lead to RCE, they fall under T1059: Command and Scripting Interpreter or T1610: Deploy Container, depending on the specific exploitation method used post-compromise.
Mitigation strategies must prioritize immediate remediation of this vulnerability. The most effective solution is to update the PPOM – Product Addons & Custom Fields for WooCommerce plugin to a version newer than 34.0.10, where the vendor has presumably patched the input validation in the rename_files function. Until an official patch is applied or if no further updates are released by the developer, administrators should consider disabling and uninstalling the plugin if its features are not strictly necessary for their operations. Additionally, implementing strict file permission settings on the WordPress installation can limit the impact of such attacks; ensuring that the web server user has minimal write permissions to directories outside of wp-content/uploads can prevent unauthorized modifications or deletions. Regular backups should be maintained and tested regularly to ensure rapid recovery in case of successful exploitation. Monitoring logs for unusual file access patterns, particularly involving the ppom_files/confirmed directory, can also aid in early detection of attempted exploits.