What is the CVSS score of CVE-2026-32522?

CVE-2026-32522 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32522?

The Vanquish WooCommerce Support Ticket System plugin (versions prior to 18.5) contains a path traversal vulnerability enabling attackers to access files outside the intended directory, potentially…. A patch is available.

How to fix or mitigate CVE-2026-32522?

Within 24 hours: Identify all WordPress installations using Vanquish WooCommerce Support Ticket System plugin and document current versions via plugin management interface. Within 7 days: Upgrade all affected installations to version 18.5 or later per vendor advisory, conducting testing in staging environment first. Within 30 days: Implement file integrity monitoring and access controls to restrict plugin directory permissions, and review access logs for suspicious file traversal attempts targeting the plugin directory.

WordPress CVE-2026-32522

EUVD-2026-15886 HIGH

Path Traversal (CWE-22)

2026-03-25 Patchstack

GHSA-9gpq-ggj7-crmm

WordPress Path Traversal

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:14 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

18.5

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15886

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 8.6

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through < 18.5.

AnalysisAI

A path traversal vulnerability exists in the Vanquish WooCommerce Support Ticket System plugin for WordPress, affecting all versions prior to 18.5, that allows attackers to access files outside the intended directory structure. The vulnerability is classified as CWE-22 (Improper Limitation of Pathname to Restricted Directory) and enables unauthorized file access or manipulation depending on the specific implementation context. While no CVSS score or EPSS data is currently available, and KEV status is unknown, the path traversal class of vulnerability typically carries significant risk in web applications where file operations are involved.

Technical ContextAI

The WooCommerce Support Ticket System plugin (CPE: cpe:2.3:a:vanquish:woocommerce_support_ticket_system:*:*:*:*:*:*:*:*) is a WordPress plugin that manages support ticket functionality for WooCommerce stores. The vulnerability stems from insufficient input validation on pathname parameters, which is the core issue described by CWE-22. This vulnerability class occurs when user-supplied input is used to construct file paths without proper sanitization, allowing attackers to use directory traversal sequences (such as '../' or '..\') to escape the intended directory boundaries and access arbitrary files on the server's filesystem. The affected versions range from the initial release through version 18.5, suggesting the vulnerability was present throughout the plugin's lifetime until the 18.5 patch.

RemediationAI

Immediately upgrade the WooCommerce Support Ticket System plugin to version 18.5 or later, which contains the patch for this path traversal vulnerability. Users should access the WordPress plugin management interface, navigate to the installed plugins section, and update the Vanquish WooCommerce Support Ticket System plugin to the latest available version. For organizations unable to immediately patch, implement filesystem-level access controls to restrict the web server process permissions to only necessary directories, disable unnecessary file operations in the plugin configuration if options exist, and monitor access logs for suspicious path traversal attempts (patterns with '../' or '..\' sequences). Additionally, maintain regular WordPress plugin audits and enable automatic security updates where feasible. Refer to the Patchstack vulnerability database for ongoing patch status and any vendor-issued security advisories.