CVE-2026-122041

Name of the Vulnerable Software and Affected Versions Checkout Field Editor for WooCommerce (Pro) versions prior to 3.8.1

Description The plugin contains a flaw allowing unauthenticated users to delete arbitrary attachments. This occurs because the ajax remove uploaded() function lacks proper capability or ownership checks. The handler is registered for both wp ajax and wp ajax nopriv and relies only on the file handling nonce nonce, which is exposed in the public checkout page markup when a File Upload field is active. An attacker can exploit this by sending a crafted attachment id to the thwcfe remove uploaded AJAX action, potentially resulting in the loss of critical media files and a denial of service.

Recommendations Update to a version newer than 3.8.0. As a temporary mitigation, restrict the use of File Upload checkout fields to prevent the file handling nonce from being exposed on the public checkout page.