CVE-2024-10625

CVSS V2 None CVSS V3 None
Description
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Overview
  • CVE ID
  • CVE-2024-10625
  • Assigner
  • Wordfence
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-11-09T03:18:14.929Z
  • Last Modified Date
  • 2024-11-09T03:18:14.929Z
History
Created Old Value New Value Data Type Notes
2024-11-09 13:13:30 Added to TrackCVE