Perfmatters WordPress Plugin Path Traversal Vulnerability Allowing Arbitrary File Overwrite

A path traversal vulnerability allowing arbitrary file overwrite has been identified in the Perfmatters plugin for WordPress, affecting all versions through 2.5.9. The issue arises in the 'PMCS::action_handler()' method, which processes bulk actions without proper authorization checks or nonce verification. Unsanitized values from the 'snippets' parameter are passed to 'Snippet::activate()' and 'Snippet::deactivate()', ultimately leading to 'Snippet::update()' and 'file_put_contents()' being called with the traversed path. This vulnerability enables authenticated attackers with Subscriber-level access or higher to overwrite arbitrary files on the server with a fixed PHP docblock content. Such actions could corrupt critical files like '.htaccess' or 'index.php', potentially causing a denial-of-service condition.

Impact

Exploitation of this vulnerability allows for arbitrary file overwrites on the server, with the potential to disrupt website functionality by corrupting essential files.

Remediation

Users are advised to update the Perfmatters plugin to version 2.6.0 or later.