Authorization Bypass in WooCommerce Checkout Field Manager Plugin

CVE-2026-17031

What is CVE-2026-17031?

The Checkout Field Manager for WooCommerce plugin is susceptible to an authorization bypass due to insufficient checks on user permissions. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability to delete arbitrary attachments from the Media Library, posing a significant security risk for WordPress site administrators. It is crucial for users to upgrade to version 7.9.7 or later to safeguard against potential exploitation.

References