CVE-2026-104801 Details
Description
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
A vulnerability allowing unauthenticated arbitrary file deletion has been identified in the PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress, affecting all versions through 34.0.10. The issue arises from inadequate file path validation in the rename_files function, enabling attackers to delete arbitrary files on the server. This vulnerability could lead to remote code execution if a critical file, such as wp-config.php, is deleted. Additionally, the deleted file is moved byte-for-byte to the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, allowing for arbitrary file reading of any web-readable file on the server.
Users are advised to update the PPOM – Product Addons & Custom Fields for WooCommerce plugin to version 34.0.11 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PPOM | <= 34.0.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 11, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |