CVE Database /
CVE-2026-13251
CVE · High
CVE-2026-13251 — Perfmatters [perfmatters] < 2.6.5
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-13251
|
Perfmatters [perfmatters] < 2.6.5 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
High
7.5
|
< 2.6.5
|
2.6.5 |
2026-07-01 |
—
|
CVE-2026-13251
The Perfmatters WordPress plugin has a security flaw that allows unauthorized access to server files via the 's' parameter in all versions prior to 2.6.4, particularly when Local Google Fonts is enabled and other specific plugin settings are active. This vulnerability enables attackers to view sensitive data contained within arbitrary files on the server without needing authentication.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings