The vulnerability identified as CVE-2026-32522 involves improper limitation of a pathname to a restricted directory (path traversal) in the vanquish WooCommerce Support Ticket System. This flaw affects versions before 18.5 and allows remote attackers to manipulate file paths without authentication, potentially causing a denial of service condition. The CVSS v3.1 score is 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is limited to availability with no confidentiality or integrity loss reported. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service, impacting system availability. There is no indication of confidentiality or integrity compromise. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations are provided in the available data.