Authorization Bypass in WooCommerce Checkout Field Manager Plugin by WordPress

CVE-2025-13930

What is CVE-2025-13930?

The Checkout Field Manager for WooCommerce plugin for WordPress suffers from an authorization bypass vulnerability, affecting versions up to 7.8.5. This flaw arises from the plugin's inadequacy in verifying user authorization before allowing the deletion of attachments. Particularly, unregistered users can exploit this weakness to delete attachments tied to guest orders by simply utilizing the publicly accessible wooccm_upload nonce and attachment ID, potentially leading to unauthorized data manipulation.

References