CVE-2026-120560: Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the gettabledata() AJAX handler — registered for unauthenticated access via wpajaxnoprivwootgettabledata — performing no nonce verification and no capability check before passing the attacker-supplied wpcolumnsactions parameter directly to applyfilters() alongside an attacker-controlled integer derived from the tableid parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads directory by supplying a known or guessed numeric attachment ID, enabling complete erasure of a site's media library. Exploitation is achievable because WordPress core registers wpdeleteattachment() as a callback on hooks such as upgraderscheduledcleanup and importerscheduledcleanup, which sanitizekey() does not strip; notably, only attachment posts reachable by numeric ID are affected, and files outside wp-content/uploads — such as wp-config.php or plugin PHP files — cannot be targeted through this path.
Event History
Frequently Asked Questions
Does exploitation require a WordPress account or administrative access?
No. The affected AJAX handler is registered for unauthenticated access and performs neither nonce verification nor a capability check.
What does an attacker need to identify before attempting deletion?
The attacker needs a known or guessed numeric ID for a WordPress media-library attachment. Only attachment posts reachable by numeric ID can be targeted.
Can this be used to delete WordPress configuration, plugin, or other non-upload files?
No. The affected deletion path removes the attachment and its underlying file in the uploads directory. Files outside wp-content/uploads, including wp-config.php and plugin PHP files, cannot be targeted through this issue.