Critical · 10.0 CVE-2025-60235 EUVD-2025-38109GHSA-c6wq-6jc2-6vpr

WordPress Support Ticket System for WooCommerce plugin <= 2.0.7 - Arbitrary File Upload vulnerability

Published Nov 6, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Plugify Product: Support Ticket System for WooCommerce (Premium) Category: Web / CMS

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Support Ticket System for WooCommerce (Premium) support-ticket-system-for-woocommerce allows Using Malicious Files.This issue affects Support Ticket System for WooCommerce (Premium): from n/a through <= 2.0.7.

Affected products

Vendor	Product	Affected	Fixed
Plugify	Support Ticket System for WooCommerce (Premium)	≤ 2.0.7	—

References

https://patchstack.com/database/Wordpress/Plugin/support-ticket-system-for-woocommerce/vulnerability/wordpress-helpdesk-support-ticket-system-for-woocommerce-plugin-2-0-7-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry