CVE-2026-104801: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in themeisle PPOM – Product Addons & Custom Fields for WooCommerce

CVE-2026-104801 is a path traversal vulnerability (CWE-22) in the themeisle PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress. The vulnerability exists due to insufficient validation of file paths in the rename_files function, allowing unauthenticated attackers to delete arbitrary files on the server. The deleted files are byte-identically moved to a publicly accessible directory (wp-content/uploads/ppom_files/confirmed/), which also enables arbitrary file read of web-readable files. This can lead to remote code execution when critical files such as wp-config.php are deleted. The vulnerability affects all versions up to and including 34.0.10. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on integrity and availability.

An unauthenticated attacker can delete arbitrary files on the affected server, potentially removing critical files like wp-config.php, which can lead to remote code execution. Additionally, the vulnerability allows attackers to read arbitrary files that are web-accessible by relocating them to a public directory. This compromises the integrity and availability of the server and can lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from the vendor themeisle and apply patches promptly once released.