CVE-2026-2421

Name of the Vulnerable Software and Affected Versions ilGhera Carta Docente for WooCommerce plugin for WordPress versions up to and including 1.5.0

Description The software contains a path traversal flaw in all versions up to and including 1.5.0, accessible through the cert parameter of the 'wccd-delete-certificate' AJAX action. Insufficient validation of the file path before deletion allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server, such as wp-config.php. Successful exploitation could lead to site takeover and remote code execution.

Recommendations Update the ilGhera Carta Docente for WooCommerce plugin to a version later than 1.5.0.