Vulnerability · Published Nov 7, 2026 · Assigned by Wordfence
CVE-2026-122041Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action
Critical 9.1
In plain English
A critical-severity missing authorization in Checkout Field Editor for WooCommerce (Pro) from Themehigh. There are no confirmed reports of exploitation so far.
Official description
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Themehigh | Checkout Field Editor for WooCommerce (Pro) | 0 – through 3.8.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H