The WooCommerce Support Ticket System plugin for WordPress suffers from a CWE-22 path traversal vulnerability (CVE-2024-10626) in the delete_uploaded_file() function. This flaw allows authenticated users with low privileges (Subscriber-level and above) to delete arbitrary files on the server by bypassing file path restrictions. Such arbitrary file deletion can escalate to remote code execution if key files are removed. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker with Subscriber-level access or higher can delete arbitrary files on the server hosting the vulnerable plugin. This can result in remote code execution if critical files such as wp-config.php are deleted. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to trusted users only and monitor for suspicious activity related to file deletions. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates closely for a security patch.