Arbitrary File Deletion in TicketBAI Facturas Plugin for WooCommerce

CVE-2025-4564

What is CVE-2025-4564?

The TicketBAI Facturas para WooCommerce plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation through the 'delpdf' action. This vulnerability can be exploited by unauthenticated attackers to delete any file on the server, potentially leading to severe consequences such as remote code execution if critical files like wp-config.php are targeted. It is crucial for users of this plugin to apply necessary updates and pay close attention to security practices to safeguard their systems.

References