CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ThemeHigh Checkout Field Editor for WooCommerce (Pro) | <= 3.8.0 | No fix listed |
| wordpress woocommerce-checkout-field-editor-pro(WordPress) | < 3.8.1 | 3.8.1 |
References
- www.wordfence.com
- www.themehigh.com
- Wordfence Intelligence third-party-advisory
- www.cve.org