Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

WooCommerce Support Ticket System Plugin Allows Unauthenticated File Deletion

CVE-2024-10625 · published 1 year ago
Summary

The WooCommerce Support Ticket System plugin for WordPress is open to a security risk that could allow hackers to delete files on the server. This could lead to serious problems, including the potential for hackers to execute malicious code on the server. To stay safe, update the plugin to the latest version or remove it if not in use.

What to do
  • Update vanquish woocommerce_support_ticket_system to version 17.8 or later.
Affected software
VendorProductAffected versions
vanquish woocommerce_support_ticket_system < 17.8
cpe:2.3:a:vanquish:woocommerce_support_ticket_system:*:*:*:*:*:wordpress:*:*
Original advisory text
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versio...
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published9 Nov 2024
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-10625 · NVD
CVE-2024-10625 · OSV
Track software like this
Free during beta