CVE-2026-120560

Name of the Vulnerable Software and Affected Versions Active Woot Products Tables for WooCommerce versions prior to 2.1.6

Description Unauthenticated attackers can delete any WordPress media library attachment and its associated file in the uploads directory. This occurs because the get table data() AJAX handler, registered via wp ajax nopriv woot get table data, fails to perform nonce verification or capability checks. An attacker can pass a specific value to the wp columns actions parameter and a numeric attachment ID via the table id parameter, which are then processed by apply filters(). This allows the execution of wp delete attachment() through hooks like upgrader scheduled cleanup and importer scheduled cleanup. This issue is limited to attachment posts reachable by numeric ID within the wp-content/uploads directory.

Recommendations Update to version 2.1.6 or later.