CVE-2026-2421: WordPress Carta Docente Path Traversal Flaw

CVE-2026-2421 Overview

The ilGhera Carta Docente for WooCommerce plugin for WordPress contains a Path Traversal vulnerability (CWE-22) in all versions up to, and including, 1.5.0. The flaw exists in the cert parameter of the wccd-delete-certificate AJAX action, which fails to properly validate file paths before executing file deletion operations. This insufficient validation allows authenticated attackers with Administrator-level privileges to delete arbitrary files on the server, including critical configuration files such as wp-config.php.

Critical Impact

Successful exploitation enables attackers to delete arbitrary server files, potentially leading to complete site takeover and remote code execution through manipulation of WordPress configuration.

Affected Products

• ilGhera Carta Docente for WooCommerce plugin versions up to and including 1.5.0
• WordPress installations using the affected plugin versions
• WooCommerce-enabled sites with the vulnerable plugin installed

Discovery Timeline

• 2026-03-20 - CVE-2026-2421 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-2421

Vulnerability Analysis

This Path Traversal vulnerability stems from improper input validation in the certificate deletion functionality of the ilGhera Carta Docente plugin. The wccd-delete-certificate AJAX action accepts a cert parameter that specifies which certificate file to delete. However, the plugin fails to adequately sanitize this parameter before performing file system operations.

Without proper path validation, an attacker can craft malicious input containing directory traversal sequences (such as ../) to escape the intended certificate directory and target any file accessible to the web server process. The deletion of critical files like wp-config.php can render the WordPress installation inoperable and may facilitate further attacks, including potential remote code execution through site reconfiguration.

While the vulnerability requires Administrator-level authentication, compromised administrator accounts or scenarios involving rogue administrators make this a significant security risk requiring immediate remediation.

Root Cause

The root cause of this vulnerability is insufficient file path validation in the class-wccd-admin.php file. The plugin directly uses user-supplied input from the cert parameter to construct file paths for deletion operations without implementing proper canonicalization or restricting the file path to the expected directory. This allows path traversal sequences to be processed, enabling arbitrary file deletion outside the intended scope.

Attack Vector

The attack is conducted over the network and requires authenticated access with Administrator-level privileges. An attacker exploits the vulnerability by sending a crafted AJAX request to the wccd-delete-certificate action with a manipulated cert parameter containing directory traversal sequences. The lack of path sanitization allows the attacker to navigate to any accessible directory on the server and delete files, such as the WordPress configuration file.

The vulnerability exists in the AJAX handler within class-wccd-admin.php. The cert parameter value is used directly in file deletion operations without proper validation to ensure the target path remains within the expected certificate directory. An attacker can inject path traversal sequences like ../../../wp-config.php to target critical WordPress files. For technical implementation details, refer to the WordPress Plugin Code Review.

Detection Methods for CVE-2026-2421

Indicators of Compromise

• Unexpected deletion of critical WordPress files such as wp-config.php, .htaccess, or core WordPress files
• AJAX requests to the wccd-delete-certificate action containing path traversal sequences (../) in the cert parameter
• Web server access logs showing suspicious POST requests to admin-ajax.php with action=wccd-delete-certificate
• Sudden WordPress site failures or database connection errors indicating configuration file tampering

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns in AJAX requests targeting WooCommerce-related actions
• Implement file integrity monitoring (FIM) on critical WordPress files including wp-config.php, .htaccess, and core directories
• Configure IDS/IPS rules to detect and alert on directory traversal sequences in HTTP POST parameters
• Enable detailed logging for WordPress AJAX actions and review for unusual certificate deletion requests

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions to monitor file system activities on web servers
• Configure alerts for deletion of files outside the expected plugin directories
• Implement real-time log analysis for administrator-level AJAX actions in WordPress
• Establish baseline monitoring for normal plugin behavior to detect anomalous file operations

How to Mitigate CVE-2026-2421

Immediate Actions Required

• Update the ilGhera Carta Docente for WooCommerce plugin to version 1.5.1 or later immediately
• Review web server access logs for any evidence of exploitation attempts
• Verify the integrity of critical WordPress files including wp-config.php and .htaccess
• Audit administrator account access and ensure all accounts use strong, unique credentials with multi-factor authentication

Patch Information

The vulnerability has been addressed in version 1.5.1 of the ilGhera Carta Docente for WooCommerce plugin. The patch implements proper file path validation to prevent directory traversal attacks. Site administrators should update to the patched version through the WordPress plugin repository. For details on the fix, refer to the patched code implementation and the Wordfence vulnerability report.

Workarounds

• Temporarily disable the ilGhera Carta Docente for WooCommerce plugin until the update can be applied
• Implement web application firewall (WAF) rules to block requests containing path traversal sequences targeting the wccd-delete-certificate action
• Restrict administrator access to trusted IP addresses only through server configuration
• Enable WordPress file system permissions to prevent web server write access to critical configuration files where possible

# Example .htaccess rule to block suspicious AJAX requests
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{QUERY_STRING} action=wccd-delete-certificate [NC]
RewriteCond %{QUERY_STRING} \.\.\/ [NC]
RewriteRule .* - [F,L]
</IfModule>