Perfmatters vulnerabilities
We track 4 vulnerabilities in Perfmatters products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2026.
Latest Perfmatters vulnerabilities
- 7.5 High severity
Perfmatters: Improper Limitation of a Pathname to a Restricted Directory
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can c
- 8.1 High severity
Perfmatters: Improper Limitation of a Pathname to a Restricted Directory
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method processing the bulk action `activate`/`deactivate` handlers withou
- 8.1 High severity
Perfmatters: Improper Limitation of a Pathname to a Restricted Directory
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitizati
- 8.8 High severity
Perfmatters: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Perfmatters allows Cross Site Request Forgery.This issue affects Perfmatters: from n/a through 2.1.6.