The Perfmatters plugin for WordPress is susceptible to an arbitrary file overwrite vulnerability that allows authenticated attackers to corrupt critical system files, potentially causing a denial of service.

This is a path traversal vulnerability (CWE-22) residing in the PMCS::action_handler method. It occurs due to missing authorization checks and nonce verification, allowing authenticated users with Subscriber-level access or higher to overwrite arbitrary files on the server.

Successful exploitation of this vulnerability can lead to significant system instability or denial of service by overwriting essential files such as .htaccess or index.php. Given the CVSS score of 8.1, this flaw poses a high risk to availability and integrity, as an attacker can effectively disable the website or disrupt its core functionality.

Immediate Action: Update the Perfmatters plugin to the latest version as specified by the vendor changelog. Ensure that all installed plugins are verified against the latest security patches provided by the developer.

Proactive Monitoring: Review web server access logs for anomalous POST requests targeting administrative or bulk action endpoints. Monitor file integrity for changes to critical system files within the WordPress root directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized requests to plugin-specific action handlers. Restrict administrative access to the WordPress dashboard to minimize the pool of potential attackers.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a high risk due to the potential for site-wide disruption. Organizations using the Perfmatters plugin must prioritize updating to the patched version immediately to prevent unauthorized file modification. If an immediate update is not feasible, restrict access to the WordPress administrative interface until the patch can be applied.