CVE-2026-32522: 
WordPress vulnerability analysis and mitigation

CVE-2026-32522 is a Path Traversal (Arbitrary File Deletion) vulnerability in the vanquish WooCommerce Support Ticket System WordPress plugin. It affects all versions prior to 18.5 and was reported by researcher Phat RiO on January 24, 2026, with public disclosure on March 20–25, 2026. The vulnerability carries a CVSS v3.1 base score of 8.6 (High), reflecting its network-accessible, unauthenticated attack surface and high availability impact (Patchstack, Feedly).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and arises from insufficient validation of user-supplied file path inputs within the WooCommerce Support Ticket System plugin. An unauthenticated remote attacker can craft network requests that traverse outside the intended directory boundaries, enabling arbitrary file deletion on the server. No authentication, user interaction, or elevated privileges are required for exploitation, and attack complexity is low (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the web server, including WordPress core files, plugin files, configuration files, or other critical assets. Deletion of core files can cause the affected WordPress site to become completely non-functional, resulting in a high availability impact. While the CVSS score reflects no direct confidentiality or integrity impact, deletion of security-relevant files (e.g., .htaccess) could indirectly enable further attacks or expose sensitive data (Patchstack).

No public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. However, Patchstack classifies this as high priority and notes that vulnerabilities of this type are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack, Feedly). The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify WordPress sites running the WooCommerce Support Ticket System plugin version below 18.5 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths.
2. Identify vulnerable endpoint: Locate the plugin's file-handling functionality (e.g., ticket attachment management endpoints) that accepts user-controlled file path parameters.
3. Craft path traversal payload: Construct an HTTP request with a path traversal sequence (e.g., ../../wp-config.php or ../../../.htaccess) in the file path parameter to reference files outside the plugin's intended directory.
4. Send unauthenticated request: Submit the crafted request without any authentication credentials, leveraging the lack of access controls.
5. Achieve arbitrary file deletion: The server processes the traversed path and deletes the targeted file, potentially disabling the WordPress site or removing security controls (Patchstack).

• Network: Unusual HTTP requests (POST or GET) to WooCommerce Support Ticket System plugin endpoints containing path traversal sequences such as ../, ..%2F, ..%5C, or URL-encoded variants in file path parameters.
• Logs: Web server access logs showing requests with traversal patterns targeting plugin endpoints (e.g., /wp-content/plugins/woocommerce-support-ticket-system/) from unexpected or repeated source IPs; HTTP 200 responses to requests with traversal payloads.
• File System: Unexpected absence of WordPress core files (e.g., wp-config.php, index.php, .htaccess), plugin files, or theme files; timestamps of file deletions correlating with suspicious log entries.
• Process: WordPress site returning errors or becoming non-functional following suspicious requests, indicating critical file deletion.

The vendor has released version 18.5 of the WooCommerce Support Ticket System plugin, which patches this vulnerability. All site administrators should update to version 18.5 or later immediately. For environments where immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to detect and block path traversal patterns in requests, and restrict access to plugin endpoints via server-level controls. Patchstack users have access to a virtual patch/mitigation rule that blocks exploitation attempts until the plugin is updated (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of March 16–22, 2026, highlighting it as part of broader WordPress plugin security coverage (Wordfence). The vulnerability was also noted on Mastodon via The Hacker Wire, indicating some community awareness. No major vendor statements or significant researcher commentary beyond the Patchstack advisory have been observed.