CVE-2026-120560

The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the get table data() AJAX handler — registered for unauthenticated access via wp ajax nopriv woot get table data — performing no nonce verification and no capability check before passing the attacker-supplied wp columns actions parameter directly to apply filters() alongside an attacker-controlled integer derived from the table id parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads directory by supplying a known or guessed numeric attachment ID, enabling complete erasure of a site's media library. Exploitation is achievable because WordPress core registers wp delete attachment() as a callback on hooks such as upgrader scheduled cleanup and importer scheduled cleanup, which sanitize key() does not strip; notably, only attachment posts reachable by numeric ID are affected, and files outside wp-content/uploads — such as wp-config.php or plugin PHP files — cannot be targeted through this path.