What’s Vulnerable › Vulnerabilities

CVE-2024-10626: WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-09 · updated 2026-06-17
• Weakness: CWE-22

Description

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affected products

• vanquish WooCommerce Support Ticket System: before 17.8 — fixed in 17.8

How to fix

Upgrade to a fixed version: vanquish WooCommerce Support Ticket System 17.8. Check the vendor advisory for mitigations.

References

• https://codecanyon.net/item/woocommerce-support-ticket-system/17930050
• https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb2c829-579f-41e2-ad5f-8e4fc125d980?source=cve

Get alerted when CVE-2024-10626 or the next vulnerability affects your stack