The flaw in the Perfmatters WordPress plugin allows an authenticated user with Subscriber level or higher to supply arbitrary paths through the 'snippets' parameter. Because the action handler processes these paths without sanitization or authorization checks, the plugin writes directly to the specified location using file_put_contents. This path traversal leads to overwriting of critical files such as .htaccess or index.php, potentially causing denial of service or enabling remote code execution if the attacker writes malicious content.

WordPress installations using the Perfmatters plugin, versions 2.5.9 and earlier, are affected. Any site running one of those releases without an updated version is vulnerable.

The vulnerability scores a 8.1 on the CVSS scale, indicating high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. Likely exploitation requires a user authenticated as Subscriber or higher, and the attacker can trigger the overwrite by directing the plugin to process a crafted 'snippets' request. Because the plugin lacks any nonce verification, the attack can be performed remotely if the site allows authenticated actions via the baseline login mechanism.