The Perfmatters plugin for WordPress contains a flaw in the "delete" action handler where the value of the $_GET['delete'] parameter is concatenated without sanitation or authorization checks and passed to PHP's unlink() function. If an authenticated user with Subscriber privileges or higher exploits this, they can supply path traversal sequences such as ../ to delete any file within the plugin's storage directory, including critical files like wp-config.php. Removing such a file triggers WordPress to launch its installation wizard, effectively handing full control of the site to the attacker.

All releases of Perfmatters up to and including version 2.5.9.1 are affected. The vulnerability applies to users who have authenticated access with a Subscriber role or higher, which is a common role assignment for many website owners and editors.

The severity is rated CVSS 8.1, indicating a high risk. EPSS data is not available, and the issue is not listed in the Known Exploited Vulnerabilities catalog. Exploitation requires only a valid authenticated session; no additional privileges or prior setup are needed beyond standard subscriber access. The lack of input validation makes successful exploitation straightforward once credentials are present.