CVE-2026-4350 | Perfmatters Plugin up to 2.5.9.1 on WordPress PMCS::action_handler delete path traversal

A vulnerability described as critical has been identified in Perfmatters Plugin up to 2.5.9.1 on WordPress. Affected by this vulnerability is the function PMCS::action_handler. The manipulation of the argument delete results in path traversal.

This vulnerability is known as CVE-2026-4350. It is possible to launch the attack remotely. No exploit is available.