---
id: "CVE-2026-122041"
page: "https://infrastack.ai/live/CVE-2026-122041"
kind: "vulnerability"
aliases: ["CVE-2026-122041"]
title: "WooCommerce Checkout Field Editor Pro: unauthenticated attackers delete any WordPress attachment"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "woocommerce-checkout-field-editor-pro", "fixed": ["3.8.1"], "affected": "<= 3.8.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["checkout-field-editor", "package", "themehigh", "unauthenticated", "woocommerce", "wordpress"]
not_affected_if: ["no-file-upload-checkout-field", "plugin-not-installed"]
published_at: "2026-11-07T13:16:36+00:00"
first_seen_at: "2026-11-07T13:47:25+00:00"
updated_at: "2026-11-07T13:50:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122041", "first_seen_at": "2026-11-07T13:47:25+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-checkout-field-editor-pro/checkout-field-editor-for-woocommerce-pro-380-missing-authorization-to-unauthenticated-arbitrary-attachment-deletion-via-attachment-id-parameter-via-thwcfe-remove-uploaded-ajax-action", "first_seen_at": "2026-11-07T13:50:28+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-checkout-field-editor-pro/checkout-field-editor-for-woocommerce-pro-380-missing-authorization-to-unauthenticated-arbitrary-attachment-deletion-via-attachment-id-parameter-via-thwcfe-remove-uploaded-ajax-action"]}]
exploit_sources: []
---

# WooCommerce Checkout Field Editor Pro: unauthenticated attackers delete any WordPress attachment

Link for people: https://infrastack.ai/live/CVE-2026-122041 (this .md is for agents)

The Checkout Field Editor for WooCommerce (Pro) WordPress plugin up to and including 3.8.0 has a missing ownership check in its file-removal handler. An unauthenticated visitor can submit a crafted attachment ID to delete media files belonging to other users or posts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:woocommerce-checkout-field-editor-pro affected <= 3.8.0 fixed 3.8.1

## How to check

- Check whether the Checkout Field Editor for WooCommerce (Pro) plugin is installed and its version is `3.8.0` or lower in the WordPress plugins screen
- Check whether a File Upload checkout field is configured in the plugin settings, since the nonce is only emitted when one exists

## Fix

Update Checkout Field Editor for WooCommerce (Pro) to 3.8.1 or later (per Wordfence; ThemeHigh's own changelog not checked).

## Timeline

- 2026-11-07T13:47:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122041
- 2026-11-07T13:50:28+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-checkout-field-editor-pro/checkout-field-editor-for-woocommerce-pro-380-missing-authorization-to-unauthenticated-arbitrary-attachment-deletion-via-attachment-id-parameter-via-thwcfe-remove-uploaded-ajax-action — Wordfence (not vendor ThemeHigh) lists affected <=3.8.0, patched 3.8.1; not marked verified as no vendor page read. No exploitation or PoC found.

## Documents

- [advisory] Wordfence: Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 unauthenticated attachment deletion https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-checkout-field-editor-pro/checkout-field-editor-for-woocommerce-pro-380-missing-authorization-to-unauthenticated-arbitrary-attachment-deletion-via-attachment-id-parameter-via-thwcfe-remove-uploaded-ajax-action

## From the sources

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_