Vulnerability Description
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://www.themehigh.com/product/woocommerce-checkout-field-editor-pro/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5f2ae-8cd9-4363-9d6
FAQ
What is CVE-2026-122041?
CVE-2026-122041 is a vulnerability with a CVSS score of 9.1 (CRITICAL). The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uplo...
How severe is CVE-2026-122041?
CVE-2026-122041 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-122041?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.