Vanquish WooCommerce Support Ticket System Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the Vanquish WooCommerce Support Ticket System plugin, affecting versions prior to 18.5. This vulnerability allows for improper limitation of pathname, enabling attackers to traverse directories and potentially delete arbitrary files from the website. Such file deletion could disrupt core functionalities, leading to a broken site.

Impact

Exploitation of this vulnerability could result in the deletion of arbitrary files from the website, including critical core files, which could cause the site to malfunction or become inoperable.

Remediation

Users of the Vanquish WooCommerce Support Ticket System plugin should update to version 18.5 or later. Patchstack users can enable auto-update for vulnerable plugins.