{"id":"CVE-2026-120560","kind":"vulnerability","aliases":["CVE-2026-120560"],"related":[],"title":"WordPress WooCommerce table plugin lets anonymous visitors delete media library files","description":"The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the `get_table_data()` AJAX handler — registered for unauthenticated access via `wp_ajax_nopriv_woot_get_table_data` — performing no nonce verification and no capability check before passing the attacker-supplied `wp_columns_actions` parameter directly to `apply_filters()` alongside an attacker-controlled integer derived from the `table_id` parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads directory by supplying a known or guessed numeric attachment ID, enabling complete erasure of a site's media library. Exploitation is achievable because WordPress core registers `wp_delete_attachment()` as a callback on hooks such as `upgrader_scheduled_cleanup` and `importer_scheduled_cleanup`, which `sanitize_key()` does not strip; notably, only attachment posts reachable by numeric ID are affected, and files outside `wp-content/uploads` — such as `wp-config.php` or plugin PHP files — cannot be targeted through this path.","summary":"The Active Woot Products Tables for WooCommerce plugin exposes an unauthenticated AJAX handler that passes attacker-supplied input into a WordPress filter hook. An attacker can use it to delete any media library attachment and its file by numeric ID, erasing a site's uploaded media.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-above-2.1.5"],"how_to_check":"- Check whether the plugin is installed and its version in the WordPress admin under Plugins, or in `wp-content/plugins/` (look for the plugin's folder name)\n- Confirm whether the installed version is `2.1.5` or lower, the range the description names as vulnerable\n- Check the site's media library for attachments that have gone missing","fix":null,"status":"open","published_at":"2026-11-07T04:17:13+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","triaged_at":"2026-11-07T04:47:54+00:00","updated_at":"2026-11-07T04:47:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T04:47:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce table plugin lets anonymous visitors delete media library files","impact":"medium","summary":"The Active Woot Products Tables for WooCommerce plugin exposes an unauthenticated AJAX handler that passes attacker-supplied input into a WordPress filter hook. An attacker can use it to delete any media library attachment and its file by numeric ID, erasing a site's uploaded media.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous attackers erase media library attachments and their uploaded files","analyst_note":"Check the plugin's changelog or the WordPress.org plugin page for a fixed version and whether the handler was patched or removed.","how_to_check":"- Check whether the plugin is installed and its version in the WordPress admin under Plugins, or in `wp-content/plugins/` (look for the plugin's folder name)\n- Confirm whether the installed version is `2.1.5` or lower, the range the description names as vulnerable\n- Check the site's media library for attachments that have gone missing","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-2.1.5"],"who_is_affected":"Sites running the Active Woot Products Tables for WooCommerce plugin at version 2.1.5 or earlier are exposed, because its AJAX handler is reachable without logging in. Attackers can only reach attachments by numeric ID and cannot touch files outside the uploads directory such as wp-config.php. Sites without this plugin installed are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00077,"input_tokens":4529,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120560':14A,17A '-2026':13A,16A '/uploads':240C '100':78C '2.1.5':97C 'access':111C 'achiev':196C 'action':136C 'activ':25B,72C 'affect':233C 'ajax':35B,106C,114C 'alongsid':142C 'anonym':6A 'appli':140C 'attach':58B,167C,183C,203C,226C 'attack':40B,49B,132C,145C,160C 'attacker-control':144C 'attacker-suppli':39B,131C 'callback':206C 'cannot':248C 'capabl':126C 'check':127C 'cleanup':213C,217C 'column':135C 'complet':186C 'content':239C 'control':146C 'core':199C 'cve':12A,15A 'data':105C,119C 'delet':8A,54B,89C,162C,202C 'deriv':148C 'direct':138C 'directori':175C 'due':100C 'enabl':185C 'eras':65B 'erasur':187C 'exploit':194C 'expos':32B 'file':11A,61B,88C,171C,235C,247C 'filter':46B,141C 'free':79C 'get':103C,117C 'guess':181C 'handler':36B,107C 'hook':47B,208C 'host':21B 'id':64B,152C,184C,231C 'import':215C 'includ':96C 'input':42B 'integ':147C 'key':220C 'known':179C 'let':5A 'librari':10A,57B,87C,166C,193C 'make':155C 'media':9A,56B,70B,86C,165C,192C 'nonc':122C 'nopriv':115C 'notabl':224C 'numer':63B,182C,230C 'outsid':236C 'packag':18B 'paramet':137C,153C 'pass':38B,129C 'path':253C 'perform':120C 'php':246C 'plugin':4A,31B,80C,245C 'possibl':157C 'post':227C 'product':27B,74C 'reachabl':228C 'regist':108C,200C 'sanit':219C 'schedul':212C,216C 'self':20B 'self-host':19B 'site':67B,190C 'strip':223C 'suppli':41B,133C,177C 'tabl':3A,28B,75C,104C,118C,151C 'target':250C 'unauthent':34B,110C,159C 'under':170C 'upgrad':211C 'upload':69B,174C 'use':51B 'verif':123C 'version':92C 'via':112C 'visitor':7A 'vulner':84C 'woocommerc':2A,22B,30B,77C 'woot':26B,73C,116C 'wordpress':1A,23B,45B,82C,164C,198C 'wp':113C,134C,201C,238C 'wp-config.php':243C 'wp-content':237C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Active Woot Products Tables for WooCommerce plugin at version 2.1.5 or earlier are exposed, because its AJAX handler is reachable without logging in. Attackers can only reach attachments by numeric ID and cannot touch files outside the uploads directory such as wp-config.php. Sites without this plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120560':14A,17A '-2026':13A,16A 'anonym':6A 'cve':12A,15A 'delet':8A 'file':11A 'let':5A 'librari':10A 'media':9A 'plugin':4A 'tabl':3A 'visitor':7A 'woocommerc':2A 'wordpress':1A","search_b":"'activ':25B 'ajax':35B 'attach':58B 'attack':40B,49B 'attacker-suppli':39B 'delet':54B 'eras':65B 'expos':32B 'file':61B 'filter':46B 'handler':36B 'hook':47B 'host':21B 'id':64B 'input':42B 'librari':57B 'media':56B,70B 'numer':63B 'packag':18B 'pass':38B 'plugin':31B 'product':27B 'self':20B 'self-host':19B 'site':67B 'suppli':41B 'tabl':28B 'unauthent':34B 'upload':69B 'use':51B 'woocommerc':22B,30B 'woot':26B 'wordpress':23B,45B","search_c":"'/uploads':240C '100':78C '2.1.5':97C 'access':111C 'achiev':196C 'action':136C 'activ':72C 'affect':233C 'ajax':106C,114C 'alongsid':142C 'appli':140C 'attach':167C,183C,203C,226C 'attack':132C,145C,160C 'attacker-control':144C 'attacker-suppli':131C 'callback':206C 'cannot':248C 'capabl':126C 'check':127C 'cleanup':213C,217C 'column':135C 'complet':186C 'content':239C 'control':146C 'core':199C 'data':105C,119C 'delet':89C,162C,202C 'deriv':148C 'direct':138C 'directori':175C 'due':100C 'enabl':185C 'erasur':187C 'exploit':194C 'file':88C,171C,235C,247C 'filter':141C 'free':79C 'get':103C,117C 'guess':181C 'handler':107C 'hook':208C 'id':152C,184C,231C 'import':215C 'includ':96C 'integ':147C 'key':220C 'known':179C 'librari':87C,166C,193C 'make':155C 'media':86C,165C,192C 'nonc':122C 'nopriv':115C 'notabl':224C 'numer':182C,230C 'outsid':236C 'paramet':137C,153C 'pass':129C 'path':253C 'perform':120C 'php':246C 'plugin':80C,245C 'possibl':157C 'post':227C 'product':74C 'reachabl':228C 'regist':108C,200C 'sanit':219C 'schedul':212C,216C 'site':190C 'strip':223C 'suppli':133C,177C 'tabl':75C,104C,118C,151C 'target':250C 'unauthent':110C,159C 'under':170C 'upgrad':211C 'upload':174C 'verif':123C 'version':92C 'via':112C 'vulner':84C 'woocommerc':77C 'woot':73C,116C 'wordpress':82C,164C,198C 'wp':113C,134C,201C,238C 'wp-config.php':243C 'wp-content':237C","first_public_at":"2026-11-07T04:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120560","severity":null,"published_at":"2026-11-07T04:17:13+00:00","modified_at":"2026-11-07T04:17:13+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","fetched_at":"2026-11-07T04:45:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}