Vulnerability in Active Woot Products Tables for WooCommerce Affects WordPress Plugin

CVE-2026-120560

What is CVE-2026-120560?

The Active Woot Products Tables for WooCommerce, a free WordPress plugin, is susceptible to a security flaw that allows unauthenticated users to delete files from the WordPress media library. This vulnerability arises from a lack of nonce verification and insufficient capability checks in the get_table_data() AJAX handler, which can be exploited by supplying a manipulated wp_columns_actions parameter along with a correct attachment ID. Successful exploitation enables attackers to erase any media files in the uploads directory, while protecting non-attachment files such as core configuration files.

References