WOOCOMMERCE-CHECKOUT-FIELD-EDITOR-PRO · CVE-2026-122041 · Package
FIX → 3.8.1
The Checkout Field Editor for WooCommerce (Pro) WordPress plugin up to and including 3.8.0 has a missing ownership check in its file-removal handler. An unauthenticated visitor can submit a crafted attachment ID to delete media files belonging to other users or posts.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Checkout Field Editor for WooCommerce (Pro) plugin at version 3.8.0 or lower that have a File Upload checkout field configured. The public checkout page exposes the nonce that the flawed handler checks, so no login is needed. Sites without the plugin or without a File Upload checkout field are not exposed.
Not affected if no-file-upload-checkout-field, plugin-not-installed
Who cares checkout-field-editor, themehigh, unauthenticated, woocommerce, wordpress
3.8.0 or lower in the WordPress plugins screenUpgrade to 3.8.1
Update Checkout Field Editor for WooCommerce (Pro) to 3.8.1 or later (per Wordfence; ThemeHigh's own changelog not checked).
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.