Description

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-10-10T07:16:40.560Z",
  "pubdate": "2026-10-10T07:16:40.560Z",
  "executiveSummary": "The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a critical vulnerability involving improper file path validation within the rename_files function.\nThis vulnerability allows unauthenticated remote attackers to delete arbitrary files on the underlying filesystem by manipulating input parameters.\nThe flaw also facilitates unauthorized arbitrary file read operations, as the mechanism moves target files into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory.\nThe impact is severe, as the deletion of critical configuration files like wp-config.php can lead to a complete site takeover or facilitate remote code execution by forcing the WordPress setup routine or exposing sensitive database credentials.\nThe vulnerability affects all versions up to and including 34.0.10, necessitating immediate remediation to prevent exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input sanitization and path validation within the rename_files function of the PPOM – Product Addons & Custom Fields for WooCommerce plugin. The function fails to implement a robust allowlist or path traversal check on user-supplied file paths, allowing an attacker to reference sensitive system or application files outside of the intended directory scope.\nThe exploitation flow initiates when an unauthenticated actor submits a crafted request to the vulnerable endpoint that triggers the rename_files function. By manipulating parameters processed by this function, an attacker can specify an arbitrary absolute or relative path to a target file. Because the application logic does not validate if the requested file path resides within the authorized uploads directory, the function proceeds to perform a filesystem operation on the attacker-specified file.\nThe primary impact is a dual-threat: file deletion and information disclosure. When the function processes the request, it executes a move or rename operation that relocates the target file into the publicly accessible directory located at wp-content/uploads/ppom_files/confirmed/. If the attacker targets a sensitive file such as wp-config.php, the file is relocated, effectively removing it from its original configuration path, which renders the site unreachable and triggers a re-installation state. Concurrently, the file becomes accessible via a direct HTTP request to the new location within the uploads directory, exposing sensitive credentials including database passwords and secret keys.\nSuccessful exploitation of this vulnerability results in arbitrary file deletion, which can lead to a complete service outage or, when combined with subsequent application configuration state changes, potential remote code execution. The vulnerability is exploitable by unauthenticated attackers without any special privileges, as the vulnerable function is exposed via a public-facing entry point. The lack of validation on the destination move path combined with the exposure of the destination directory creates a high-severity security risk, enabling both system-level destructive actions and critical data theft."
}