CVE-2026-13251 describes a directory traversal vulnerability in the Perfmatters WordPress plugin affecting all versions up to and including 2.6.4. The flaw is exploitable through the 's' parameter when specific plugin settings are enabled: Local Google Fonts (disabled by default), pretty permalinks, and RSS feed links. This allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact.

An unauthenticated attacker can remotely read arbitrary files on the affected server, potentially exposing sensitive information. This can lead to information disclosure without requiring authentication or user interaction. The impact is limited to confidentiality, with no direct integrity or availability effects reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should ensure the Local Google Fonts feature is disabled (default setting), disable pretty permalinks or RSS feed links in the plugin settings to mitigate exploitation risk. Monitor vendor channels for official patches or updates.