CVE-2026-13251

Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter

CVSS 7.5 HIGHEPSS 0.8%CWE-22

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

02 jul 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the Local Google Fonts feature to be enabled (disabled by default), pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

perfmatters · Perfmatters

Referências

https://perfmatters.io/docs/changelog/https://plugins.trac.wordpress.org/browser/perfmatters/trunk/inc/classes/Fonts.php#L131 https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0082ff-2a33-44e9-b0d0-8b9a404ab648?source=cve