CVE-2026-2421 is a path traversal vulnerability (CWE-22) in the ilGhera Carta Docente for WooCommerce plugin for WordPress. The vulnerability exists in all versions up to and including 1.5.0 and is triggered via the 'cert' parameter of the 'wccd-delete-certificate' AJAX action. Because the plugin does not properly validate file paths before deleting files, an authenticated attacker with Administrator-level access can delete arbitrary files on the server. This can result in severe impacts such as site takeover and remote code execution. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

An authenticated attacker with Administrator-level access can delete arbitrary files on the server, including critical files like wp-config.php. This can lead to site takeover and remote code execution, severely impacting the integrity and availability of the affected system. There is no direct confidentiality impact reported. No known exploits in the wild have been identified at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file deletions. Consider disabling or removing the vulnerable plugin if possible to mitigate risk.