PPOM WooCommerce plugin: Unauthenticated arbitrary file deletion
Summary
The PPOM plugin (Product Addons & Custom Fields for WooCommerce) for WordPress does not validate file paths sufficiently in its rename_files function, affecting all versions up to and including 34.0.10. An unauthenticated attacker can delete arbitrary files on the server, for example wp-config.php, which can lead to remote code execution. The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, so it can also be read by anyone.
Affected
- PPOM – Product Addons & Custom Fields for WooCommerce (WordPress plugin, ThemeIsle)
- All versions up to and including 34.0.10 (Wordfence: any version affected)
Fixed in
- Fixed in 34.0.11 according to WPScan
- Current release listed on wordpress.org: 34.0.12 (2026-10-22)
- The 34.0.11 changelog text could not be verified.
Workaround
- No vendor workaround known. Update the plugin to the fixed version.
- If an update cannot be applied immediately, deactivate the plugin on internet-facing shops (recommendation of the research, not a vendor statement).
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial
- Not listed in CISA KEV
- EPSS 0.00755 (low predicted probability)
- No public proof of concept found
- Exploitation in the wild: unknown
Our recommendation
- Update PPOM to 34.0.11 or later (currently 34.0.12) on all sites, including reachable staging copies, and verify the installed version in the WordPress admin.
- Check wp-content/uploads/ppom_files/confirmed/ for unexpected files.
- Review web server and file system logs for unusual requests to checkout and upload paths before the update.
- Check for signs of compromise if an affected version was exposed. Treat a web application firewall only as a temporary layer, not a replacement for the update.
- Priority: high.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- CVE record summary (threatint) cve.threatint.com
- WPScan plugin page wpscan.com
- WordPress.org plugin page wordpress.org
- Plugin code changeset 3733313 plugins.trac.wordpress.org
- Affected code Handler.php (tag 34.0.10) plugins.trac.wordpress.org
- Shell Bulletin report shellbulletin.com
- OpenCVE CVE page app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:01.
Original description (NVD)
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
NVD references (6)
- https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Files/Handler.php#L738
- https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Support/Helpers.php#L224
- https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Cart/CartHa…
- https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Order/Order…
- https://plugins.trac.wordpress.org/changeset/3733313/woocommerce-product-addon/trunk/src/WooCommerce/Order/Or…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/650b510f-dc13-4ba4-af68-187f516b3051?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.