WooCommerce Plugin Allows Arbitrary File Deletion by Shop Managers

The Order Tip for WooCommerce plugin contains a critical authorization bypass vulnerability that permits Shop Manager role users and above to delete arbitrary files from the web server without proper capability checks or path validation. This vulnerability is particularly dangerous because WooCommerce sites often manage sensitive business data, customer information, and core application files. Any user with Shop Manager privileges—a role commonly delegated to multiple team members—can exploit this flaw to delete critical files needed for site operation, database files, configuration files containing credentials, or even WordPress core files, resulting in complete site compromise or denial of service.

While this CVE currently lacks mapped MITRE ATT&CK techniques, Casky's security skills powered by Claude AI would detect the attack patterns associated with this vulnerability across several threat categories. Practitioners using Casky would identify findings related to improper input validation, insecure file operations, and privilege escalation indicators—specifically detecting when file deletion requests bypass authorization checks or access controls. The platform's 754 mapped security skills would flag suspicious patterns including: inadequate capability verification before sensitive operations, unrestricted file path parameters that allow directory traversal, and role-based access control failures. Security teams would see alerts highlighting that Shop Manager roles executed file system operations without proper admin-level checks, combined with detections of unexpected file deletions outside normal application workflows, enabling rapid identification and remediation before attackers can leverage this authorization flaw for lateral movement or persistence.