Unauthenticated File Upload Vulnerability in WooCommerce Checkout Field Manager Plugin

CVE-2025-12500

What is CVE-2025-12500?

The WooCommerce Checkout Field Manager plugin for WordPress contains a vulnerability that allows unauthenticated attackers to upload files to the server. This issue arises due to insufficient verification of user authorization when utilizing the 'ajax_checkout_attachment_upload' function. Although the vulnerability is restricted to uploads of files conforming to WordPress's permitted MIME types (such as images and documents), it poses a significant risk to the integrity and security of the application. All versions up to and including 7.8.1 are affected, making it essential for users to secure their installations against potential exploitation.

References