CVE-2026-104801: Kerentanan Kritis PPOM di WordPress

CVE ID	CVE-2026-104801
Severity	CRITICAL — CVSS CVSS V3.1 9.1
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE	CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Produk	themeisle / PPOM – Product Addons & Custom Fields for WooCommerce — 0 (affected)
Dipublikasikan	2026-10-10

Ringkasan Cepat

• CVE-2026-104801 adalah kerentanan CRITICAL 9.1 pada plugin PPOM – Product Addons & Custom Fields for WooCommerce, semua versi hingga 34.0.10.
• Karena validasi path tidak memadai di fungsi rename_files, penyerang tanpa autentikasi dapat menghapus file arbitrer di server.
• Dampak mencakup potensi RCE jika file penting seperti wp-config.php terhapus, serta pembacaan file arbitrer karena file dipindahkan ke wp-content/uploads/ppom_files/confirmed/.

Ringkasan Kerentanan

CVE-2026-104801 adalah kerentanan yang diberi judul CNA PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter. Deskripsi resmi menyebutkan plugin PPOM – Product Addons & Custom Fields for WooCommerce untuk WordPress rentan terhadap penghapusan file arbitrer karena validasi jalur file yang tidak memadai pada fungsi rename_files di semua versi hingga dan termasuk 34.0.10.

Penyerang tanpa autentikasi dapat menghapus file arbitrer di server. Severity dinilai CRITICAL 9.1 dengan vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Kelemahan dipetakan ke CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). Publikasi CVE tercatat pada 10 Oktober 2026.

Dampak Teknis

Kerentanan ini memungkinkan arbitrary file deletion oleh aktor yang tidak terautentikasi. Menurut deskripsi resmi, file yang dipindahkan juga dibawa secara identik byte ke direktori yang dapat diakses publik wp-content/uploads/ppom_files/confirmed/. Artinya, selain penghapusan file, serangan juga berakibat pada arbitrary file read untuk file apa pun yang dapat dibaca web di server.

Risiko terburuk adalah remote code execution (RCE) jika file yang tepat terhapus, misalnya wp-config.php. Pada CVSS, dampak integritas dan ketersediaan dinilai tinggi (I:H, A:H) dalam vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Karena vektor serangannya network, kompleksitas rendah, tanpa privilege, dan tanpa interaksi pengguna, prioritas penanganan harus tinggi.

Produk Terdampak

Produk yang terdampak adalah plugin PPOM – Product Addons & Custom Fields for WooCommerce dengan vendor themeisle. Berdasarkan deskripsi resmi, semua versi hingga dan termasuk 34.0.10 rentan. Data produk pada CVE mencantumkan versi '0 (affected)'.

Kerentanan ini relevan bagi situs WordPress yang menjalankan WooCommerce dan menggunakan plugin PPOM, terutama jika situs dapat diakses publik. Referensi teknis mencakup tautan Wordfence Threat Intel, beberapa file sumber pada tag 34.0.10, dan changeset patch 3733313.

Konteks dan Prioritas

Dengan nilai 9.1 CRITICAL dan status unauthenticated, CVE-2026-104801 termasuk kelas kerentanan yang harus diprioritaskan. Penyerang tidak perlu memiliki akun di WordPress, sehingga permukaan serangan mencakup seluruh instalasi yang terekspos jika plugin aktif dan belum dipatch.

Karena file yang dipindahkan masuk ke direktori publik wp-content/uploads/ppom_files/confirmed/, organisasi juga perlu menilai paparan file sensitif yang dapat dibaca web dan memastikan direktori tersebut tidak dapat diakses sembarang orang. Patch tersedia melalui changeset 3733313; administrator disarankan mengikuti rilis resmi plugin untuk pembaruan yang tepat.

Mitigasi dan Perbaikan

• Segera perbarui plugin PPOM ke versi terbaru yang tersedia setelah 34.0.10, atau terapkan patch dari changeset 3733313. Jika pembaruan belum memungkinkan, nonaktifkan plugin untuk sementara.
• Prioritaskan audit dan perbaikan pada situs WordPress/WooCommerce yang memakai PPOM dan dapat diakses internet, karena kerentanan tidak memerlukan autentikasi.
• Batasi akses web ke direktori wp-content/uploads/ppom_files/confirmed/ melalui aturan server, WAF, atau konfigurasi web server, serta periksa file yang berada di dalamnya.
• Pantau log akses untuk permintaan yang memuat parameter ppom[fields][<data_name>][n][org] dan aktivitas file mencurigakan di uploads/ppom_files/confirmed/.
• Terapkan least privilege pada filesystem web server dan pastikan backup terverifikasi tersedia agar pemulihan cepat jika wp-config.php atau file penting lain terhapus.

Referensi Resmi

• CVE-2026-104801 — CVE Program (cve.org)
• https://www.wordfence.com/threat-intel/vulnerabilities/id/650b510f-dc13-4ba4-af68-187f516b3051?source=cve
• https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Order/OrderHandler.php#L287
• https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Cart/CartHandler.php#L369
• https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Support/Helpers.php#L224
• https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Files/Handler.php#L738
• https://plugins.trac.wordpress.org/changeset/3733313/woocommerce-product-addon/trunk/src/WooCommerce/Order/OrderHandler.php

Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.

Pertanyaan yang Sering Diajukan (FAQ)

Apa itu CVE-2026-104801?

Ini adalah CVE untuk kerentanan arbitrary file deletion tanpa autentikasi pada plugin PPOM – Product Addons & Custom Fields for WooCommerce, akibat validasi jalur file yang tidak memadai di fungsi rename_files.

Apakah eksploitasi memerlukan autentikasi?

Tidak. Judul dan deskripsi resmi menyatakan kerentanan ini unauthenticated, sehingga penyerang tidak perlu login ke WordPress.

Versi PPOM mana yang terdampak?

Semua versi hingga dan termasuk 34.0.10. Entri produk pada data CVE mencantumkan vendor themeisle dan versi 0 (affected).

Apa dampak terburuknya?

Penghapusan file arbitrer dapat menyebabkan remote code execution jika file yang tepat terhapus, misalnya wp-config.php. Selain itu, file yang dipindahkan ke wp-content/uploads/ppom_files/confirmed/ dapat menyebabkan arbitrary file read untuk file yang dapat dibaca web.

Apakah sudah ada patch?

Referensi CVE menyertakan changeset 3733313 sebagai patch. Administrator disarankan memantau rilis resmi PPOM dan menerapkan pembaruan sesegera mungkin.

Apa mitigasi sementara jika belum bisa update?

Nonaktifkan plugin sementara, batasi akses ke direktori upload PPOM yang disebut, pantau log, dan pastikan backup serta least privilege filesystem diterapkan.

English Version — CVE-2026-104801: Critical PPOM Vulnerability in WordPress

Quick Summary

• CVE-2026-104801 is a CRITICAL 9.1 vulnerability in the PPOM – Product Addons & Custom Fields for WooCommerce plugin, all versions up to 34.0.10.
• Due to inadequate path validation in the rename_files function, an unauthenticated attacker can delete arbitrary files on the server.
• Impact includes potential RCE if critical files such as wp-config.php are deleted, as well as arbitrary file read because files are moved to wp-content/uploads/ppom_files/confirmed/.

Vulnerability Overview

CVE-2026-104801 is a vulnerability titled by the CNA PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter. The official description states that the PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to and including 34.0.10.

An unauthenticated attacker can delete arbitrary files on the server. Severity is rated CRITICAL 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The weakness is mapped to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). CVE publication was recorded on October 10, 2026.

Technical Impact

This vulnerability allows arbitrary file deletion by an unauthenticated actor. According to the official description, moved files are also carried byte-identically to the publicly accessible directory wp-content/uploads/ppom_files/confirmed/. This means that in addition to file deletion, the attack also results in arbitrary file read for any web-readable file on the server.

The worst-case risk is remote code execution (RCE) if the right file is deleted, for example wp-config.php. In CVSS, integrity and availability impacts are rated high (I:H, A:H) in vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Because the attack vector is network, complexity is low, no privileges are required, and no user interaction is needed, remediation priority should be high.

Affected Products

The affected product is the PPOM – Product Addons & Custom Fields for WooCommerce plugin with vendor themeisle. Based on the official description, all versions up to and including 34.0.10 are vulnerable. The product data in the CVE lists version '0 (affected)'.

This vulnerability is relevant to WordPress sites running WooCommerce and using the PPOM plugin, especially if the site is publicly accessible. Technical references include a Wordfence Threat Intel link, several source files at tag 34.0.10, and patch changeset 3733313.

Context and Priority

With a score of 9.1 CRITICAL and unauthenticated status, CVE-2026-104801 belongs to the class of vulnerabilities that must be prioritized. An attacker does not need to have a WordPress account, so the attack surface includes the entire exposed installation if the plugin is active and unpatched.

Because moved files enter the public directory wp-content/uploads/ppom_files/confirmed/, organizations also need to assess the exposure of web-readable sensitive files and ensure that directory cannot be accessed by unauthorized parties. A patch is available via changeset 3733313; administrators are advised to follow the plugin's official release for the appropriate update.

Mitigation

• Immediately update the PPOM plugin to the latest version available after 34.0.10, or apply the patch from changeset 3733313. If updating is not yet possible, temporarily deactivate the plugin.
• Prioritize auditing and remediation on internet-accessible WordPress/WooCommerce sites using PPOM, because the vulnerability does not require authentication.
• Restrict web access to the wp-content/uploads/ppom_files/confirmed/ directory through server rules, WAF, or web server configuration, and inspect the files inside it.
• Monitor access logs for requests containing the ppom[fields][<data_name>][n][org] parameter and for suspicious file activity in uploads/ppom_files/confirmed/.
• Apply least privilege to the web server filesystem and ensure verified backups are available so recovery is fast if wp-config.php or another critical file is deleted.

FAQ (English)

What is CVE-2026-104801?

It is a CVE for an unauthenticated arbitrary file deletion vulnerability in the PPOM – Product Addons & Custom Fields for WooCommerce plugin, caused by insufficient file path validation in the rename_files function.

Does exploitation require authentication?

No. The official title and description state that this vulnerability is unauthenticated, so an attacker does not need to log in to WordPress.

Which PPOM versions are affected?

All versions up to and including 34.0.10. The product entries in the CVE data list vendor themeisle and version 0 (affected).

What is the worst-case impact?

Arbitrary file deletion can lead to remote code execution if the right file is deleted, such as wp-config.php. In addition, files moved to wp-content/uploads/ppom_files/confirmed/ can lead to arbitrary file read for web-readable files.

Is there a patch?

The CVE references include changeset 3733313 as a patch. Administrators are advised to monitor the official PPOM release and apply the update as soon as possible.

What temporary mitigation is available if updating is not possible?

Temporarily deactivate the plugin, restrict access to the mentioned PPOM upload directory, monitor logs, and ensure backups and least privilege filesystem are in place.