Authorization Bypass in WooCommerce Checkout Field Manager Plugin by WordPress

CVE-2025-13930

What is CVE-2025-13930?

The Checkout Field Manager for WooCommerce plugin for WordPress suffers from an authorization bypass vulnerability, affecting versions up to 7.8.5. This flaw arises from the plugin's inadequacy in verifying user authorization before allowing the deletion of attachments. Particularly, unregistered users can exploit this weakness to delete attachments tied to guest orders by simply utilizing the publicly accessible wooccm_upload nonce and attachment ID, potentially leading to unauthorized data manipulation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References