PPOM WooCommerce Flaw Lets Attackers Delete Files, Execute Code and Steal Server Data

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a critical security flaw that allows unauthenticated attackers to delete arbitrary files on the server. According to the National Vulnerability Database record for CVE-2026-104801, this issue affects all plugin versions up to and including 34.0.10. The vulnerability carries a CVSS score of 9.1, rating it as critical severity.

In plain English

The flaw exists because the plugin’s rename_files function does not properly validate file paths. An attacker can exploit this weakness to delete any file on the server that the web server process has permission to access. Deleting specific configuration files, such as wp-config.php, can easily lead to remote code execution. This means an attacker could take full control of the WordPress site hosting the vulnerable plugin.

The background

When an attacker deletes a file using this method, the file is not simply erased. Instead, the relocated file is moved byte-identically into a publicly accessible directory. Specifically, the file ends up in the wp-content/uploads/ppom_files/confirmed/ folder on the server. This behavior creates a secondary risk of arbitrary file read. Attackers can view the contents of any web-readable file on the server by forcing the plugin to move it to this public location.

What changes now

Security teams must immediately identify any WordPress installations using the PPOM plugin. The vulnerability is present in all versions up to 34.0.10, meaning a vast number of sites are potentially exposed. Because the attack requires no authentication, automated bots can scan for and exploit this flaw rapidly. The combination of file deletion and file read capabilities makes this one of the most dangerous types of WordPress plugin vulnerabilities.

Background: WordPress plugin vulnerabilities

Secure your WordPress instance by enforcing strict plugin vetting, isolating execution environments, and maintaining rigorous update cycles. This checklist provides specific technical controls to reduce attack surface, prevent privilege escalation, and ensure rapid incident response when vulnerabilities are discovered in third-party code.

Read the full guide: WordPress Plugin Vulnerability Prevention Checklist

What to do and how to stay safe: PPOM

• Check your WordPress plugin list for PPOM – Product Addons & Custom Fields for WooCommerce and verify the installed version.
• Review server access logs for unusual activity related to file renaming or requests to the ppom_files directory.
• Monitor the vendor’s website or security advisories for the release of a patched version of the plugin.
• Restrict file permissions on the server to limit what the web server process can delete or move if possible.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the PPOM plugin are affected by CVE-2026-104801?

All versions of the PPOM – Product Addons & Custom Fields for WooCommerce plugin up to and including version 34.0.10 are affected.

Can an attacker read sensitive files using this vulnerability?

Yes, deleted files are moved to a publicly accessible directory, allowing attackers to read the contents of any web-readable file on the server.

Is authentication required to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to delete arbitrary files and potentially achieve remote code execution on the server.