Log in / Sign up

Vulnerability details

CVE-2026-122041

ThemeHigh Checkout Field Editor for WooCommerce

Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action

CVSS 3.1
9.1Critical

Official description

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.

CVSS scores

ScoreVersionSourceVector
9.1Critical 3.1 CVEProject cvelistV5 (CNA) (Wordfence) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

VendorProductVersionsSource
ThemeHigh Checkout Field Editor for WooCommerce (Pro) v ≤ 3.8.0 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-11-07
Last updated
2026-11-07
State
Published
Assigner (CNA)
Wordfence
Kolun priority
24 · Low

Exploit prediction (EPSS)

0.47%
Probability of exploitation in 30 days
41.5%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-862
    Missing Authorization