The vulnerability allows an attacker to delete arbitrary files from the server by exploiting a path traversal flaw in the WooCommerce Support Ticket System plugin. This weakness, identified as CWE-22, can compromise file integrity and potentially lead to denial of service if critical system or plugin files are removed.

The WooCommerce Support Ticket System plugin for WordPress, provided by vanquish, is affected in all releases prior to version 18.5. The flaw is present in every version from its introduction until the identified fix in 18.5.

The CVSS base score of 8.6 indicates high severity, while an EPSS score of less than 1% suggests a low but non-zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attacks are likely to target sites where users can trigger ticket deletion operations; based on the description, it is inferred that an attacker would need access to the plugin’s deletion functionality, which typically requires authenticated administrative access. If exploited, an attacker could delete arbitrary files, compromising the availability, confidentiality, or integrity of the WordPress installation.