Platform
wordpress
Component
woocommerce-support-ticket-system
Fixed in
17.6.1
CVE-2024-10625 represents a critical security vulnerability affecting the WooCommerce Support Ticket System plugin for WordPress. This vulnerability allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution. The issue stems from insufficient file path validation within the plugin and impacts versions up to and including 17.7. A patch is available, and immediate action is recommended.
The impact of CVE-2024-10625 is severe due to the potential for remote code execution. An attacker exploiting this vulnerability could delete critical WordPress configuration files, such as wp-config.php, effectively gaining control of the entire WordPress installation. This could lead to data breaches, website defacement, malware injection, and complete compromise of the server. The ease of exploitation, requiring no authentication, significantly increases the risk. Deletion of other sensitive files could also expose database credentials or other confidential information.
CVE-2024-10625 was publicly disclosed on November 9, 2024. While no active exploitation campaigns have been definitively confirmed, the vulnerability's ease of exploitation and critical severity make it a high-priority target. The potential for RCE elevates this vulnerability to a significant risk. Public proof-of-concept exploits are likely to emerge, further increasing the risk of exploitation.
Exploit Status
EPSS
40.62% (97% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-10625 is to immediately upgrade the WooCommerce Support Ticket System plugin to a version that addresses the vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting file uploads and deleting any temporary upload directories. Implement strict file permissions on the WordPress installation to limit the impact of a successful file deletion. Monitor WordPress logs for suspicious file deletion activity. After upgrading, confirm the fix by attempting a file deletion request through a vulnerable endpoint and verifying that the request is denied.
Update the WooCommerce Support Ticket System plugin to the latest available version. The vulnerability allows for arbitrary file deletion, which could compromise the security of the website.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-10625 is a critical vulnerability in the WooCommerce Support Ticket System plugin allowing unauthenticated attackers to delete arbitrary files, potentially leading to remote code execution.
If you are using WooCommerce Support Ticket System version 17.6 or earlier, you are affected by this vulnerability and should upgrade immediately.
Upgrade the WooCommerce Support Ticket System plugin to the latest version that addresses the vulnerability. If immediate upgrade is not possible, implement temporary workarounds like restricting file uploads.
While no confirmed active exploitation campaigns have been reported, the vulnerability's severity and ease of exploitation make it a high-priority target, and exploitation is likely.
Refer to the WooCommerce security advisory for detailed information and updates: [https://woocommerce.com/security/](https://woocommerce.com/security/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.