The TicketBAI Facturas para WooCommerce plugin suffers from CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Specifically, the 'delpdf' action does not properly validate file paths, enabling unauthenticated attackers to delete arbitrary files on the server. This vulnerability affects all versions up to 3.18 and can lead to remote code execution by deleting critical files such as wp-config.php. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical impact and ease of exploitation. There is no vendor advisory or patch link currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the affected server. This can cause denial of service and potentially enable remote code execution if critical files like wp-config.php are deleted. The vulnerability has a critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling or removing it to prevent exploitation. Monitor for updates from the vendor or trusted security sources for an official patch or mitigation instructions.