{"id":"CVE-2026-122041","kind":"vulnerability","aliases":["CVE-2026-122041"],"related":[],"title":"WooCommerce Checkout Field Editor Pro: unauthenticated attackers delete any WordPress attachment","description":"The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.","summary":"The Checkout Field Editor for WooCommerce (Pro) WordPress plugin up to and including 3.8.0 has a missing ownership check in its file-removal handler. An unauthenticated visitor can submit a crafted attachment ID to delete media files belonging to other users or posts.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"woocommerce-checkout-field-editor-pro","fixed":["3.8.1"],"affected":"<= 3.8.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["checkout-field-editor","package","themehigh","unauthenticated","woocommerce","wordpress"],"not_affected_if":["no-file-upload-checkout-field","plugin-not-installed"],"how_to_check":"- Check whether the Checkout Field Editor for WooCommerce (Pro) plugin is installed and its version is `3.8.0` or lower in the WordPress plugins screen\n- Check whether a File Upload checkout field is configured in the plugin settings, since the nonce is only emitted when one exists","fix":"Update Checkout Field Editor for WooCommerce (Pro) to 3.8.1 or later (per Wordfence; ThemeHigh's own changelog not checked).","status":"open","published_at":"2026-11-07T13:16:36+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:12+00:00","updated_at":"2026-11-07T13:50:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T13:49:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce Checkout Field Editor Pro: unauthenticated attackers delete any WordPress attachment","impact":"medium","summary":"The Checkout Field Editor for WooCommerce (Pro) WordPress plugin up to and including 3.8.0 has a missing ownership check in its file-removal handler. An unauthenticated visitor can submit a crafted attachment ID to delete media files belonging to other users or posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","checkout-field-editor"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attackers delete arbitrary media attachments, causing data loss and possible denial of service","analyst_note":"Fixed version not stated in the sources; check the plugin's changelog or the WordPress.org plugin page for the first patched release.","how_to_check":"- Check whether the Checkout Field Editor for WooCommerce (Pro) plugin is installed and its version is `3.8.0` or lower in the WordPress plugins screen\n- Check whether a File Upload checkout field is configured in the plugin settings, since the nonce is only emitted when one exists","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-file-upload-checkout-field"],"who_is_affected":"Sites running the Checkout Field Editor for WooCommerce (Pro) plugin at version 3.8.0 or lower that have a File Upload checkout field configured. The public checkout page exposes the nonce that the flawed handler checks, so no login is needed. Sites without the plugin or without a File Upload checkout field are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000758,"input_tokens":4394,"output_tokens":637,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Fixed version not stated in the sources; check the plugin's changelog or the WordPress.org plugin page for the first patched release.","search":"'-122041':14A,17A '-2026':13A,16A '3.8.0':46B,113C 'ajax':103C,121C,124C 'arbitrari':93C,166C 'attach':11A,65B,94C,167C,180C 'attack':7A,163C 'attribut':148C 'belong':71B,170C 'capability/ownership':99C 'check':51B,100C 'checkout':2A,20A,25B,34B,78C,142C,153C 'checkout-field-editor':24B 'configur':156C 'craft':64B,179C 'cve':12A,15A 'data':146C 'data-nonc':145C 'delet':8A,68B,91C,165C 'denial':192C 'due':95C 'editor':4A,22A,27B,36B,80C 'emit':138C 'field':3A,21A,26B,35B,79C,154C 'file':55B,70B,132C,151C 'file-remov':54B 'function':106C 'gate':128C 'handl':133C 'handler':57B,115C 'id':66B,181C 'import':188C 'includ':45B,112C,168C 'insid':139C 'lead':184C 'loss':186C 'make':158C 'markup':144C 'media':69B,189C 'miss':49B,98C 'nonc':134C,135C,147C 'nopriv':125C 'ownership':50B 'packag':28B 'page':143C 'plugin':41B,84C 'possibl':160C 'post':76B,175C 'potenti':191C 'pro':5A,23A,39B,83C 'public':141C 'regist':117C 'remov':56B,104C 'servic':194C 'sole':129C 'submit':62B,177C 'themehigh':29B 'unauthent':6A,30B,59B,162C 'unauthor':90C 'upload':105C,152C 'user':74B,173C 'version':108C 'visitor':60B 'vulner':88C 'whenev':149C 'woocommerc':1A,31B,38B,82C 'woocommerce':19A 'woocommerce-checkout-field-editor-pro':18A 'wordpress':10A,32B,40B,86C 'wp':120C,123C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Checkout Field Editor for WooCommerce (Pro) plugin at version 3.8.0 or lower that have a File Upload checkout field configured. The public checkout page exposes the nonce that the flawed handler checks, so no login is needed. Sites without the plugin or without a File Upload checkout field are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["woocommercecheckoutfieldeditorpro"],"ptokens":["checkout","editor","field","pro","woocommerce"],"labels":["checkoutfieldeditor","critical","package","themehigh","unauthenticated","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-122041':14A,17A '-2026':13A,16A 'attach':11A 'attack':7A 'checkout':2A,20A 'cve':12A,15A 'delet':8A 'editor':4A,22A 'field':3A,21A 'pro':5A,23A 'unauthent':6A 'woocommerc':1A 'woocommerce':19A 'woocommerce-checkout-field-editor-pro':18A 'wordpress':10A","search_b":"'3.8.0':46B 'attach':65B 'belong':71B 'check':51B 'checkout':25B,34B 'checkout-field-editor':24B 'craft':64B 'delet':68B 'editor':27B,36B 'field':26B,35B 'file':55B,70B 'file-remov':54B 'handler':57B 'id':66B 'includ':45B 'media':69B 'miss':49B 'ownership':50B 'packag':28B 'plugin':41B 'post':76B 'pro':39B 'remov':56B 'submit':62B 'themehigh':29B 'unauthent':30B,59B 'user':74B 'visitor':60B 'woocommerc':31B,38B 'wordpress':32B,40B","search_c":"'3.8.0':113C 'ajax':103C,121C,124C 'arbitrari':93C,166C 'attach':94C,167C,180C 'attack':163C 'attribut':148C 'belong':170C 'capability/ownership':99C 'check':100C 'checkout':78C,142C,153C 'configur':156C 'craft':179C 'data':146C 'data-nonc':145C 'delet':91C,165C 'denial':192C 'due':95C 'editor':80C 'emit':138C 'field':79C,154C 'file':132C,151C 'function':106C 'gate':128C 'handl':133C 'handler':115C 'id':181C 'import':188C 'includ':112C,168C 'insid':139C 'lead':184C 'loss':186C 'make':158C 'markup':144C 'media':189C 'miss':98C 'nonc':134C,135C,147C 'nopriv':125C 'page':143C 'plugin':84C 'possibl':160C 'post':175C 'potenti':191C 'pro':83C 'public':141C 'regist':117C 'remov':104C 'servic':194C 'sole':129C 'submit':177C 'unauthent':162C 'unauthor':90C 'upload':105C,152C 'user':173C 'version':108C 'vulner':88C 'whenev':149C 'woocommerc':82C 'wordpress':86C 'wp':120C,123C","first_public_at":"2026-11-07T13:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122041","severity":null,"published_at":"2026-11-07T13:16:36+00:00","modified_at":"2026-11-07T13:16:36+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122041:2125","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-checkout-field-editor-pro/checkout-field-editor-for-woocommerce-pro-380-missing-authorization-to-unauthenticated-arbitrary-attachment-deletion-via-attachment-id-parameter-via-thwcfe-remove-uploaded-ajax-action","severity":null,"published_at":"2026-11-07T13:50:28+00:00","modified_at":"2026-11-07T13:50:28+00:00","first_seen_at":"2026-11-07T13:50:28+00:00","fetched_at":"2026-11-07T13:50:28+00:00","note":"Wordfence (not vendor ThemeHigh) lists affected <=3.8.0, patched 3.8.1; not marked verified as no vendor page read. No exploitation or PoC found.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-checkout-field-editor-pro/checkout-field-editor-for-woocommerce-pro-380-missing-authorization-to-unauthenticated-arbitrary-attachment-deletion-via-attachment-id-parameter-via-thwcfe-remove-uploaded-ajax-action"]}],"documents":[{"id":95877,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-checkout-field-editor-pro/checkout-field-editor-for-woocommerce-pro-380-missing-authorization-to-unauthenticated-arbitrary-attachment-deletion-via-attachment-id-parameter-via-thwcfe-remove-uploaded-ajax-action","title":"Wordfence: Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 unauthenticated attachment deletion","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}