Urgent: Patch PPOM WooCommerce Plugin to Block Unauthenticated RCE and File Deletion Attack

The PPOM – Product Addons & Custom Fields for WooCommerce plugin contains a critical security flaw that allows unauthenticated attackers to delete arbitrary files on WordPress servers. According to the National Vulnerability Database, this vulnerability affects all plugin versions up to and including 34.0.10. The issue stems from insufficient file path validation within the plugin’s rename_files function, creating a significant risk for site owners who rely on this tool for customizing product options.

The National Vulnerability Database rates CVE-2026-104801 as Critical with a CVSS score of 9.1. This high severity rating reflects the ease with which an attacker can exploit the weakness without needing any form of authentication or user credentials. The flaw is classified under CWE-22, which denotes improper limitation of a pathname to a restricted directory. This path traversal issue allows malicious actors to target files outside the intended scope of the plugin’s file management capabilities.

How the Exploit Works

The vulnerability enables attackers to delete arbitrary files on the server hosting the WordPress site. According to the NVD record, deleting critical configuration files such as wp-config.php can easily lead to remote code execution. When an attacker successfully deletes a file, the plugin moves the relocated file byte-identically into a publicly accessible directory. This directory is located at wp-content/uploads/ppom_files/confirmed/, meaning the attack also results in arbitrary file read access for any web-readable file on the server.

This mechanism effectively exposes sensitive data to the public internet. Because the moved files are placed in a publicly accessible folder, anyone can view the contents of files that were previously restricted to server-side access. This arbitrary file read capability complements the file deletion risk, allowing attackers to harvest sensitive information such as database credentials or API keys before or after deleting critical system files.

Who Is Affected

The vulnerability impacts all installations of the PPOM – Product Addons & Custom Fields for WooCommerce plugin developed by ThemeIsle. According to the source material, every version up to and including 34.0.10 is vulnerable to this arbitrary file deletion and read attack. Small-business owners using WooCommerce to sell products with custom addons are particularly at risk if they have not updated their plugins recently.

WordPress sites that use this plugin for customizing product fields are exposed to unauthenticated attacks. The lack of authentication requirements means that automated scanning tools can identify and exploit this weakness at scale. Site administrators must verify their current plugin version immediately, as any version prior to the next release after 34.0.10 remains susceptible to this critical flaw.

What to watch

No patch or fix has been confirmed yet in the provided source material. Site owners should monitor official ThemeIsle announcements and WordPress security feeds for an updated version that resolves CVE-2026-104801. Until a fix is released, the risk of unauthorized file deletion and data exposure remains active for all affected installations.

Security researchers may release proof-of-concept exploits that demonstrate how to leverage this path traversal bug. Such tools could increase the volume of attacks against vulnerable sites. Administrators should watch for unusual traffic patterns or unexpected file changes in the wp-content/uploads directory, which could indicate an ongoing exploitation attempt.

What to do and how to stay safe: PPOM

• Check your WordPress plugin list to see if you are running PPOM version 34.0.10 or earlier.
• Consider temporarily disabling the plugin if you do not need its functionality until a secure update is available.
• Monitor server logs for unauthorized access attempts to the wp-content/uploads/ppom_files/confirmed/ directory.
• Ensure your web server has strict file permissions to limit the impact of potential file deletions.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The vulnerability is identified as CVE-2026-104801 in the National Vulnerability Database.

Do attackers need a password to exploit this bug?

No, the National Vulnerability Database states that unauthenticated attackers can exploit this flaw without credentials.

Which plugin versions are affected by this issue?

All versions of the PPOM plugin up to and including 34.0.10 are vulnerable to this path traversal bug.