CVE-2026-122041: Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action

Q: Which installations are exposed to unauthenticated requests?

An installation is exposed when it uses an affected version and has a File Upload checkout field configured. In that case, the public checkout page includes the file_handling_nonce needed by the AJAX handler.

Q: Does an attacker need a WordPress account or permission to delete attachments?

No. The affected handler is available through the unauthenticated AJAX route and does not enforce a capability or attachment-ownership check. An attacker can obtain the nonce from public checkout markup and submit a crafted attachment_id.

Q: What content could be affected by a successful request?

The issue permits deletion of arbitrary WordPress attachments, including attachments associated with other users or posts. This can cause loss of media and denial of service where deleted attachments are required by the site.

Published Nov 7, 2026

Updated

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajaxremoveuploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wpajax and wpajaxnopriv and is gated solely by the 'filehandlingnonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachmentid, which can lead to loss of important media and potential denial of service.

Event History

Nov 7, 2026

CVE Published

via MITRE·12:27 PM

Data Sourced

via MITRE·12:27 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed to unauthenticated requests?

An installation is exposed when it uses an affected version and has a File Upload checkout field configured. In that case, the public checkout page includes the file_handling_nonce needed by the AJAX handler.

Does an attacker need a WordPress account or permission to delete attachments?

No. The affected handler is available through the unauthenticated AJAX route and does not enforce a capability or attachment-ownership check. An attacker can obtain the nonce from public checkout markup and submit a crafted attachment_id.

What content could be affected by a successful request?

The issue permits deletion of arbitrary WordPress attachments, including attachments associated with other users or posts. This can cause loss of media and denial of service where deleted attachments are required by the site.

CVE-2026-122041: Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action

Event History

Frequently Asked Questions

Which installations are exposed to unauthenticated requests?

Does an attacker need a WordPress account or permission to delete attachments?

What content could be affected by a successful request?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed to unauthenticated requests?

Does an attacker need a WordPress account or permission to delete attachments?

What content could be affected by a successful request?