How Does the PPOM Plugin Flaw Expose WooCommerce Sites to Total Compromise?

The PPOM – Product Addons & Custom Fields for WooCommerce plugin contains a critical security flaw that allows unauthenticated attackers to delete arbitrary files on WordPress servers. According to the National Vulnerability Database record for CVE-2026-104801, this vulnerability exists in all versions up to and including 34.0.10. The issue stems from insufficient file path validation within the plugin’s rename_files function, creating a significant risk for organisations using this popular e-commerce extension.

Security researchers have assigned a CVSS score of 9.1 to this vulnerability, classifying it as Critical due to the ease of exploitation and the severity of the potential impact. The flaw enables remote attackers to target specific system files without needing login credentials. By deleting configuration files such as wp-config.php, adversaries can disrupt site operations and potentially achieve remote code execution. This means an attacker could gain full control over the web server hosting the WooCommerce store, compromising customer data and transaction integrity.

Context and background

The vulnerability is rooted in CWE-22, a common weakness related to path traversal issues. The rename_files function in the PPOM plugin fails to properly validate the paths of files being processed. This oversight allows an attacker to manipulate the file path arguments, directing the plugin to delete files outside the intended directory structure. The National Vulnerability Database highlights that this lack of validation is the primary vector for the attack, making it accessible to any unauthenticated user who can interact with the plugin’s endpoints.

Furthermore, the mechanism of the attack involves more than just deletion. When a file is targeted for deletion via this flaw, it is not immediately removed from the server. Instead, the relocated file is moved byte-identically into a publicly accessible directory at wp-content/uploads/ppom_files/confirmed/. This behaviour results in arbitrary file read capabilities for any web-readable file on the server. Attackers can thus extract sensitive information, such as database credentials or private keys, by triggering the deletion of specific files and then accessing the copied content in the public uploads folder.

Who is affected

Any organisation running WordPress with the PPOM – Product Addons & Custom Fields for WooCommerce plugin installed is potentially affected. The vulnerability impacts all versions up to and including 34.0.10, which covers a wide range of deployments. Since the plugin is developed by themeisle, sites using this specific e-commerce tool for custom fields and product addons are at risk. The unauthenticated nature of the exploit means that even visitors who have not logged into the site can trigger the attack, making every instance of the vulnerable plugin a potential entry point for malicious actors.

Business leaders should note that the impact extends beyond simple data leakage. The ability to delete critical configuration files can lead to service outages, while the subsequent remote code execution risk allows for complete server compromise. This creates a dual threat of availability disruption and confidentiality breach. Organisations must assess their exposure by identifying all instances of the PPOM plugin across their WordPress infrastructure and verifying the installed version against the vulnerable range.

Our take on the response

No patch or fix has been confirmed yet by the vendor or in the source material. Security teams should treat this as an urgent operational risk. The combination of arbitrary file deletion and read access provides attackers with a powerful toolkit for initial access and lateral movement. Until a vendor update is released, the primary mitigation strategy involves reducing the attack surface. This may include temporarily disabling the plugin if business operations allow, or implementing strict web application firewall rules to block suspicious requests targeting the rename_files function.