CVE-2026-2421: 
WordPress vulnerability analysis and mitigation

CVE-2026-2421 is a Path Traversal vulnerability in the ilGhera Carta Docente for WooCommerce WordPress plugin that allows authenticated administrators to delete arbitrary files on the server. All versions up to and including 1.5.0 are affected. The vulnerability was published on March 20, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, ENISA EUVD).

The root cause is insufficient file path validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in the wccd-delete-certificate AJAX action handler located in includes/class-wccd-admin.php. The cert parameter passed to this action is not properly sanitized or restricted to a safe directory before being used in a file deletion operation, allowing path traversal sequences (e.g., ../../) to reference files outside the intended upload directory. An attacker with Administrator-level WordPress credentials can craft a malicious AJAX request to delete critical server files such as wp-config.php, which can trigger WordPress's installation mode and enable site takeover or remote code execution (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated administrator to delete arbitrary files on the web server, including critical WordPress configuration files like wp-config.php. Deletion of wp-config.php causes WordPress to enter setup mode, potentially allowing an attacker to reconfigure the database connection and achieve full site takeover. This can further enable remote code execution, complete loss of data integrity, and service disruption (availability impact), though there is no direct confidentiality impact from the file deletion itself (Wordfence, ENISA EUVD).

Exploitation requires Administrator-level authentication, which limits the attack surface but does not eliminate risk in multi-admin environments or scenarios where admin credentials are compromised. No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.0054 (0.54%), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, ENISA EUVD).

1. Authenticate as Administrator: Log in to the target WordPress site with an account that has Administrator-level privileges or higher.
2. Identify the vulnerable plugin: Confirm the ilGhera Carta Docente for WooCommerce plugin (version ≤ 1.5.0) is installed and active.
3. Craft a malicious AJAX request: Construct an HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action set to wccd-delete-certificate and the cert parameter containing a path traversal payload (e.g., cert=../../wp-config.php).
4. Submit the request: Send the crafted request with valid authentication cookies/nonce. The plugin will process the cert parameter without adequate path validation and delete the specified file.
5. Trigger site takeover: With wp-config.php deleted, navigate to the WordPress site root. WordPress will enter installation mode, allowing the attacker to reconfigure the database connection and gain full control of the site, potentially enabling remote code execution via theme/plugin upload (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with action=wccd-delete-certificate and cert parameter values containing ../ or encoded path traversal sequences.
• File System: Absence of wp-config.php in the WordPress root directory; unexpected deletion of other core or configuration files; WordPress entering installation/setup mode unexpectedly.
• Logs: PHP error logs or WordPress debug logs showing file deletion operations referencing paths outside the plugin's expected upload directory.
• Process: Unexpected WordPress reinstallation activity or new database configuration entries following the file deletion event.

The vendor released version 1.5.1 of the ilGhera Carta Docente for WooCommerce plugin, which includes a fix for the path traversal vulnerability by adding proper file path validation in the wccd-delete-certificate AJAX handler. All site administrators should update to version 1.5.1 or later immediately. As a temporary workaround prior to patching, consider restricting access to the WordPress admin AJAX endpoint for untrusted administrator accounts, or temporarily deactivating the plugin (Wordfence, WordPress Trac).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of March 16–22, 2026, highlighting it as part of their ongoing threat intelligence coverage (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified.