Unauthorized Attachment Deletion in Checkout Field Editor for WooCommerce Plugin

CVE-2026-122041

What is CVE-2026-122041?

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is susceptible to unauthorized deletion of arbitrary attachments due to a missing capability and ownership verification in the ajax_remove_uploaded() function. This vulnerability impacts versions up to 3.8.0 and allows unauthenticated attackers to exploit the handler, which operates through both wp_ajax and wp_ajax_nopriv, relying solely on the 'file_handling_nonce' nonce. By submitting a crafted attachment_id, attackers can delete attachments belonging to any user, potentially leading to significant data loss and service disruptions.

References