CVE-2026-104801

Name of the Vulnerable Software and Affected Versions PPOM – Product Addons & Custom Fields for WooCommerce versions prior to 34.0.11

Description Insufficient file path validation in the rename files() function allows unauthenticated attackers to delete arbitrary files on the server. This action can lead to remote code execution if critical files, such as wp-config.php, are deleted. Additionally, the process moves the targeted file into the publicly accessible wp-content/uploads/ppom files/confirmed/ directory, enabling arbitrary file read for any web-readable file on the server.

Recommendations Update PPOM – Product Addons & Custom Fields for WooCommerce to version 34.0.11 or later. As a temporary mitigation, restrict access to the rename files() function.