PPOM WooCommerce Flaw Can Delete Files: Fix

If you run the PPOM – Product Addons & Custom Fields for WooCommerce plugin, check your version today: every version up to and including 34.0.10 has a critical flaw that lets a stranger delete files from your server without logging in. Update, then confirm the changelog explicitly mentions a fix for this issue. If no fix is documented, or you are still on 34.0.10 or lower, deactivate the plugin and ideally delete it until a fix is confirmed.

This post is for owners of WooCommerce stores (and the people who look after them) who want a plain-English answer. You will learn what the flaw is, how to check whether you are affected, the exact steps to fix it, and what to look for afterward. You do not need to be technical to follow along.

What is the PPOM vulnerability?

PPOM is a popular WordPress plugin that adds extra fields to WooCommerce product pages. Think engraving text, file uploads, size pickers or gift messages. Its plugin folder name is woocommerce-product-addon.

The flaw is tracked as CVE-2026-104801. A CVE is simply a public ID number for a known security bug. According to the National Vulnerability Database (NVD), a function in the plugin called rename_files does not properly check file paths. That weakness type is called path traversal (CWE-22). In plain terms, the plugin can be tricked into working on files outside the folder it is supposed to stay in.

The NVD description says an unauthenticated attacker (someone with no account on your site) can use this to delete arbitrary files on the server.

Why deleting one file can be a big deal

Deleting files sounds like vandalism, not a takeover. The NVD description warns it can easily lead to remote code execution (an attacker running their own commands on your server) when the right file is deleted. Its example is wp-config.php.

That file holds your database login and tells WordPress how to start. If it disappears, WordPress can fall back to its setup screen. Someone who reaches that screen first may be able to connect your site to a database they control. That is how a deleted file can turn into a full takeover.

The description also says the file is not just removed. It is moved, byte for byte, into the public folder wp-content/uploads/ppom_files/confirmed/. Because that folder is reachable from the web, the attack can also expose any web-readable file on the server.

How serious is it?

The NVD lists a CVSS score of 9.1 out of 10, rated Critical. CVSS is the standard scoring system for how bad a bug is. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Here is what that means:

One detail worth knowing: the score lists confidentiality (reading private data) as none, yet the description says arbitrary file read is also possible. Treat the description as the safer guide and assume file exposure is possible too.

The NVD also marks this record's analysis status as Deferred, so it has not been fully enriched. That is why the affected versions come from the description only.

Who is affected?

The description says all versions up to and including 34.0.10 are vulnerable. The NVD record does not name a fixed version or confirm that a patched version exists, so we will not guess one. The safe rule is: install the newest version the plugin offers, then read its changelog and check that it explicitly mentions a fix for this path traversal or arbitrary file deletion issue.

One caution on the second row. The source does not say a deactivated plugin is safe. PHP files left on disk can sometimes be requested directly, even when the plugin is switched off. If your store does not need PPOM, deleting it is the safe option.

How to fix it: step by step

1. Check your version. In WordPress, go to Plugins > Installed Plugins and find PPOM – Product Addons & Custom Fields for WooCommerce. The version number sits under its name.
2. Take a backup. Use your host's backup tool or a backup plugin. Back up both files and database.
3. Update the plugin. Go to Dashboard > Updates, tick the plugin and click Update Plugins. Or click Update now on the Plugins page.
4. Test a product. Open a product that uses add-on fields, add it to the cart and go to checkout. Check that uploads and custom fields still work.
5. Confirm the fix. Check the new version number, then read the changelog on the WordPress.org plugin page. It should explicitly mention a fix for this path traversal or arbitrary file deletion issue. A higher version number alone is not proof.
6. If no fix is documented, or the version is still 34.0.10 or lower, deactivate the plugin and ideally delete it until a fixed version is confirmed.

If you have command line access, WP-CLI does the same job:

wp plugin list --fields=name,status,version,update_version | grep product-addon
wp plugin update woocommerce-product-addon

The first command shows your version and whether an update is waiting. The second installs it. You still need to read the changelog afterward. Once a fix is confirmed, turn on automatic updates for this plugin (on the Plugins page, click Enable auto-updates) so you are not relying on your memory next time.

If you cannot update right now

Sometimes an update clashes with a theme or customization, or no fix is documented yet. Do not leave the plugin running in the meantime. If your store does not need it, delete it, because that is the safe option. If you need to keep it, deactivate it from Plugins > Installed Plugins as a stopgap. The source does not verify that deactivation fully removes the risk. Your product add-on fields will stop showing, which is a nuisance, but a store with missing fields is better than a store that can be taken over.

Your host may also be able to put a web application firewall (a filter that blocks suspicious web requests) in front of your site. Treat that as a helper, not a replacement for fixing or removing the plugin.

How to check whether someone already abused it

The NVD record does not say whether this flaw is being exploited in the wild, so we cannot say either way. The flaw may have been exploited before the CVE was published on 2026-10-10, so do not assume the risk window starts on that date. It is worth a careful look. Here is a short checklist:

• Does your site load normally? A sudden WordPress install screen, or a database connection error, is a red flag. Do not run the installer. Go to your host and restore from backup.
• Is wp-config.php still there? Look in your site's root folder using your host's File Manager or SFTP.
• Look inside the public folder. Open wp-content/uploads/ppom_files/confirmed/. The folder name suggests uploads that customers attached to orders, so compare what you see against your own recent orders. Files that do not belong are things like wp-config.php, backup archives or anything ending in .php.
• List every file if you have shell access:

find wp-content/uploads/ppom_files/confirmed -type f -ls

Review every file in that folder, not only recent ones. A file moved by rename usually keeps its original modification time, so a date filter could hide a moved wp-config.php.

• Check your logs. Ask your host for access logs and look for unusual requests to the PPOM plugin across the whole period they have available, not only after the publication date.

If you find a copy of wp-config.php or another sensitive file in that folder, treat the secrets inside as exposed. Work through these steps:

1. Delete the exposed copies from wp-content/uploads/ppom_files/confirmed/.
2. Check your server logs for downloads of those files.
3. Rotate every secret that might have been exposed. That includes your database password, your WordPress security keys (salts), admin passwords, payment gateway keys, SMTP (outgoing email) credentials, API keys and any other secrets stored in files on the server.

Then follow our website hacked guide for the cleanup steps.

What this does not tell us

The NVD entry is short. It does not give a fixed version number, confirm that a patched version exists, give a patch date or show any sign of attacks. The linked references point to the plugin's code on WordPress.org's Trac (the public code viewer), including a code changeset for the order handler and a Wordfence vulnerability entry. We only rely on the NVD description here. For details beyond it, read the vendor's changelog.

How to avoid the next plugin scare

Plugin flaws like this one are routine in WordPress. You cannot stop them from being found, but you can shrink the damage:

• Delete plugins you do not use.
• Keep WordPress core, themes and plugins updated weekly.
• Keep tested, off-site backups.
• Use unique, strong admin passwords with two-factor login.
• Run a free website security check now and then to spot missing basics.

An automated scanner can tell you that a plugin version is out of date. It cannot easily tell you how your own store is set up or what an attacker could chain together. If you want to understand the difference, read our guide on manual vs automated penetration testing.

Key takeaways

• CVE-2026-104801 is a critical (CVSS 9.1) flaw in PPOM – Product Addons & Custom Fields for WooCommerce, affecting all versions up to and including 34.0.10.
• No login is needed to attempt it, and the NVD says it can lead to deleted files, file exposure and possibly full server takeover.
• Update the plugin, then confirm the changelog explicitly mentions a fix for this issue. If no fix is documented, or the version is still 34.0.10 or lower, deactivate and ideally delete the plugin until one is confirmed.
• Check that wp-config.php is intact and review every file in wp-content/uploads/ppom_files/confirmed/. Check logs for the whole period you have, since the flaw may have been exploited before the CVE was published.
• If you find anything odd, delete the exposed copies, check logs for downloads, rotate every secret that might have been exposed, and restore a clean backup.

What to do next

Fixing or removing the plugin closes this one hole. It does not tell you what else is open on your store. If you want a person to look at the whole site, our Circuit audit is a $49 one-time manual review of a small website, with a written report of each issue, its severity, the evidence and the exact fix. It is a focused small-site audit, not an enterprise penetration test or a compliance certificate. Deal with the plugin first. Then decide if you want a second pair of eyes.