Awesome Support <= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 6.1.4. This is due to insufficient controls on paths being supplied when a user deletes an attachment from a ticket. This makes it possible for authenticated attackers, with ticket submitting-level access to delete arbitrary files on the site which can be used to achieve remote code execution and take over the site.