{"id":"CVE-2026-122041","published":"2026-11-07T13:16:36.067","lastModified":"2026-11-07T19:17:25.583","description":"The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://www.themehigh.com/product/woocommerce-checkout-field-editor-pro/","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5f2ae-8cd9-4363-9d68-8a59f81a061b?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Checkout Field Editor for WooCommerce (Pro) plugin lacks proper capability and ownership checks in its ajax_remove_uploaded() function, allowing unauthenticated attackers to delete arbitrary WordPress attachments by exploiting a publicly exposed nonce. This enables deletion of any attachment regardless of ownership or post association.","exploitability":"Exploitation is trivial for unauthenticated attackers as it only requires knowledge of an attachment ID and submission of a POST request with the public nonce found in checkout page HTML; no authentication or special privileges are needed.","blast_radius":"Successful exploitation can cause significant data loss by deleting critical media files across the site, potentially disrupting content delivery, breaking product pages, and enabling denial-of-service via systematic deletion of attachments.","remediation":"Upgrade to Checkout Field Editor for WooCommerce (Pro) version 3.8.1 or later, which addresses the missing capability and ownership checks in the ajax_remove_uploaded() handler.","detection":"Defenders should monitor WordPress debug.log and access logs for repeated POST requests to /wp-admin/admin-ajax.php?action=ajax_remove_uploaded with valid-looking nonces but suspicious attachment_id values, especially when originating from unauthenticated sessions or non-checkout page referrers; anomalous bulk deletions of attachments in wp_posts and wp_postmeta tables may also be observable.","tags":["missing-capability-check","unauthenticated-access","media-deletion","woocommerce","nonce-misuse"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:47:16.689Z"}}