What is the CVSS score of CVE-2026-2421?

CVE-2026-2421 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by CVE-2026-2421?

Organizations using for WordPress is vulnerable to Path Traversal in all should be aware of notable risk from CVE-2026-2421, a path traversal vulnerability rated CVSS 6.5.

How to fix or mitigate CVE-2026-2421?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Path Traversal in all and apply vendor patches as part of regular patch cycle. Review file handling controls.

PHP CVE-2026-2421

EUVD-2026-13636 MEDIUM

Path Traversal (CWE-22)

2026-03-20 Wordfence

WordPress PHP Path Traversal RCE

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 08:45 euvd

EUVD-2026-13636

Analysis Generated

Mar 20, 2026 - 08:45 vuln.today

CVE Published

Mar 20, 2026 - 08:25 nvd

MEDIUM 6.5

DescriptionCVE.org

The ilGhera Carta Docente for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the 'cert' parameter of the 'wccd-delete-certificate' AJAX action. This is due to insufficient file path validation before performing a file deletion. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, such as wp-config.php, which can make site takeover and remote code execution possible.

AnalysisAI

A Path Traversal vulnerability exists in the ilGhera Carta Docente for WooCommerce plugin for WordPress (versions up to and including 1.5.0) that allows authenticated administrators to delete arbitrary files on the server through insufficient validation of the 'cert' parameter in the 'wccd-delete-certificate' AJAX action. An attacker with administrator privileges can exploit this to delete critical files such as wp-config.php, leading to site takeover and potential remote code execution. The vulnerability has been documented by Wordfence security researchers and affects all versions from release through 1.5.0, with a patch available in version 1.5.1 and later.

Technical ContextAI

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka 'Path Traversal'). The affected plugin is ilGhera Carta Docente for WooCommerce (CPE: cpe:2.3:a:ghera74:ilghera_carta_docente_for_woocommerce), a WordPress plugin that integrates with WooCommerce. The flaw exists in the AJAX action handler 'wccd-delete-certificate' within the class-wccd-admin.php file (specifically at line 88 in versions up to 1.5.0, and line 80 in patched version 1.5.1). The underlying issue is inadequate server-side validation and sanitization of file paths before passing them to file deletion operations, allowing path traversal sequences (such as '../') to traverse outside intended directories and target arbitrary files on the filesystem. This is a PHP/WordPress-based vulnerability that exposes the ability to manipulate file paths through AJAX requests.

RemediationAI

The primary remediation is to upgrade the ilGhera Carta Docente for WooCommerce plugin to version 1.5.1 or later, which patches the path traversal vulnerability in the 'wccd-delete-certificate' AJAX handler. Administrators should navigate to Plugins > Installed Plugins in the WordPress admin dashboard, locate 'ilGhera Carta Docente for WooCommerce', and click 'Update Now' if an update is available, or manually update the plugin from the WordPress plugin repository. For organizations unable to patch immediately, enforce strict file permission controls and limit administrator role assignments to trusted users only, since the vulnerability requires administrator-level privileges. Additionally, monitor administrator account activity and implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, ..\, etc.) in AJAX parameters if the plugin is exposed. Regular security audits of WordPress user roles and capabilities should be conducted to minimize the attack surface. Complete remediation details and confirmation of the patch can be found in the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/wc-carta-docente/tags/1.5.1/includes/class-wccd-admin.php.