200,000+ Sites at Risk: Perfmatters Flaw Enables Full WordPress Site Takeover

Researchers disclosed CVE-2026-4350 in the Perfmatters WordPress plugin (200,000+ installs): an unauthenticated path-traversal via the plugin's snippet delete handler allows arbitrary file read/delete (including wp-config.php), enabling site reset and takeover; the vendor patched the flaw in Perfmatters v2.6.0 by adding sanitization, admin capability checks, and nonce verification.