Directory Traversal in Perfmatters WordPress Plugin

Executive Summary

The Perfmatters plugin for WordPress has a Directory Traversal vulnerability in all versions up to and including 2.6.4. This vulnerability exists via the 's' parameter, allowing unauthenticated attackers to read arbitrary files on the server.

Exploitation requires the Local Google Fonts feature to be enabled (which is disabled by default), pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to read sensitive files on the server without authentication. Such files may contain confidential information, which could lead to data leakage or further attacks.

Because the vulnerability allows reading arbitrary files, it can expose sensitive configuration files, credentials, or other private data stored on the server.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the directory traversal vulnerability in the Perfmatters WordPress plugin (CVE-2026-13251), you should immediately disable the Local Google Fonts feature if it is enabled, as exploitation requires this feature to be active.

Additionally, ensure that pretty permalinks and RSS feed links are disabled or properly configured in the plugin settings to reduce the attack surface.

Most importantly, update the Perfmatters plugin to a version later than 2.6.4 where this vulnerability is fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to read arbitrary files on the server, which can include sensitive information.

Exposure of sensitive information through this directory traversal could potentially lead to non-compliance with data protection regulations such as GDPR or HIPAA, which require protection of personal and sensitive data.

However, the provided context does not explicitly mention the impact on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability in the Perfmatters WordPress plugin involves a Directory Traversal via the 's' parameter when certain plugin features are enabled. Detection would involve checking for suspicious HTTP requests targeting the 's' parameter that attempt to access arbitrary files on the server.

Since exploitation requires the Local Google Fonts feature to be enabled, pretty permalinks active, and RSS feed links enabled in the plugin settings, verifying these configurations can help identify if the system is vulnerable.

To detect potential exploitation attempts on your network, you can monitor web server logs for requests containing directory traversal patterns in the 's' parameter, such as '../' sequences.

• Use grep or similar tools to search web server access logs for suspicious 's' parameter usage, e.g.:
• grep -i 's=\.\./' /var/log/apache2/access.log
• grep -i 's=\.\./' /var/log/nginx/access.log

Additionally, you can use curl or wget to test if the vulnerability is present by sending crafted requests to the plugin endpoint with directory traversal payloads in the 's' parameter and observing the response for file contents.

Useful 0 Not Useful 0