A critical path traversal vulnerability in the Vanquish WooCommerce Support Ticket System plugin permits unauthenticated attackers to delete arbitrary files, posing a severe risk to site integrity and availability.

The plugin fails to properly sanitize user-supplied input when handling file paths, resulting in a path traversal vulnerability (CWE-22). This flaw is exploitable by unauthenticated remote attackers to perform arbitrary file deletion operations.

The ability for an unauthenticated attacker to delete arbitrary files on the host server can lead to catastrophic system instability, total loss of data, or a complete denial of service. With a CVSS score of 8.6, this vulnerability represents a high risk to business continuity and operational reliability, as it does not require prior authentication or complex user interaction to execute.

Immediate Action: Update the WooCommerce Support Ticket System plugin to version 18.5 or later immediately. If an update is not currently possible, deactivate the plugin until a patch can be applied.

Proactive Monitoring: Review web server and application error logs for suspicious file system requests or attempts to access restricted directory paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file system manipulation attempts.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a significant risk to the availability and integrity of the affected WordPress environment. Administrators must prioritize updating the WooCommerce Support Ticket System to version 18.5 or higher to eliminate the underlying flaw. Given the potential for arbitrary file deletion, failure to apply this update leaves the system exposed to destructive unauthorized actions.