CVE-2026-122041

Summary

The Checkout Field Editor for WooCommerce (Pro) plugin lacks proper capability and ownership checks in its ajax_remove_uploaded() function, allowing unauthenticated attackers to delete arbitrary WordPress attachments by exploiting a publicly exposed nonce. This enables deletion of any attachment regardless of ownership or post association.

Exploitability

Exploitation is trivial for unauthenticated attackers as it only requires knowledge of an attachment ID and submission of a POST request with the public nonce found in checkout page HTML; no authentication or special privileges are needed.

Blast radius

Successful exploitation can cause significant data loss by deleting critical media files across the site, potentially disrupting content delivery, breaking product pages, and enabling denial-of-service via systematic deletion of attachments.

Detection

Defenders should monitor WordPress debug.log and access logs for repeated POST requests to /wp-admin/admin-ajax.php?action=ajax_remove_uploaded with valid-looking nonces but suspicious attachment_id values, especially when originating from unauthenticated sessions or non-checkout page referrers; anomalous bulk deletions of attachments in wp_posts and wp_postmeta tables may also be observable.

Prioritized remediation

Upgrade to Checkout Field Editor for WooCommerce (Pro) version 3.8.1 or later, which addresses the missing capability and ownership checks in the ajax_remove_uploaded() handler.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.