Key points
- CVE-2026-104801 affects PPOM plugin versions up to 34.0.10.
- The flaw has a CVSS score of 9.1, rated as Critical.
- Attackers can delete arbitrary files and read web-accessible content.
The PPOM – Product Addons & Custom Fields for WooCommerce plugin contains a critical security flaw that allows unauthenticated attackers to delete arbitrary files on WordPress servers. According to the National Vulnerability Database, this vulnerability exists in all plugin versions up to and including 34.0.10. The issue stems from insufficient file path validation within the rename_files function, creating a significant risk for any organization using this popular e-commerce extension.
By the numbers
- 9.1: The CVSS v3.1 base score assigned to CVE-2026-104801 by the NVD.
- 34.0.10: The maximum affected version number for the PPOM plugin.
- 0: The number of authentication steps required to exploit this vulnerability.
What the figures mean
A CVSS score of 9.1 indicates a critical severity level, meaning exploitation is technically straightforward and the impact is severe. According to the NVD record, the lack of authentication requirements allows any remote attacker to trigger the flaw. The insufficient validation in the rename_files function permits arbitrary file deletion, which can lead to remote code execution if critical files like wp-config.php are removed. Additionally, the deleted files are moved byte-identically into a publicly accessible directory, enabling arbitrary file read access for any web-readable content on the server.
What should you do?
Managed service providers should immediately audit their WordPress client portfolios for installations of the PPOM plugin. Identify all sites running version 34.0.10 or earlier, as these are vulnerable to unauthenticated attacks. Monitor server logs for unusual file deletion events or access patterns in the wp-content/uploads/ppom_files/confirmed/ directory. Since no patch has been confirmed in the source material, consider isolating affected environments or disabling the plugin until a vendor update is available.
What to do and how to stay safe: PPOM
- Inventory all WordPress sites to identify installations of the PPOM plugin version 34.0.10 or older.
- Monitor web server logs for unauthorized file access or deletion attempts targeting the rename_files function.
- Restrict public access to the wp-content/uploads/ppom_files/confirmed/ directory to mitigate file read risks.
- Prepare an incident response plan for potential remote code execution if critical configuration files are deleted.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific plugin is affected by CVE-2026-104801?
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is affected.
What versions of the plugin are vulnerable?
All versions up to and including 34.0.10 are vulnerable to this arbitrary file deletion flaw.
Can attackers exploit this without logging in?
Yes, the vulnerability allows unauthenticated attackers to delete files and potentially execute code remotely.
