# CVE-2026-120560: Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters Status: published. Published: 2026-11-07. Updated: 2026-11-08. The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the `get_table_data()` AJAX handler — registered for unauthenticated access via `wp_ajax_nopriv_woot_get_table_data` — performing no nonce verification and no capability check before passing the attacker-supplied `wp_columns_actions` parameter directly to `apply_filters()` alongside an attacker-controlled integer derived from the `table_id` parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads directory by supplying a known or guessed numeric attachment ID, enabling complete erasure of a site's media library. Exploitation is achievable because WordPress core registers `wp_delete_attachment()` as a callback on hooks such as `upgrader_scheduled_cleanup` and `importer_scheduled_cleanup`, which `sanitize_key()` does not strip; notably, only attachment posts reachable by numeric ID are affected, and files outside `wp-content/uploads` — such as `wp-config.php` or plugin PHP files — cannot be targeted through this path. ## Remediation No remediation reported in collected sources ## Affected products and versions - realmag777 / Active Woot Products Tables for WooCommerce. 100% FREE: ≥ 0; ≤ 2.1.5 (affected, semver). Source: CNA: Wordfence ## Severity and prioritization - CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L; source: CNA: Wordfence - CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L; source: NVD: security@wordfence.com - CISA KEV: No listing in collected sources - EPSS: 0.41% as of 2026-11-08; percentile 35.97% - SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP - Weaknesses: CWE-22 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4962c61-9059-4fb9-9ddf-5e6aa1d2675a?source=cve (CNA: Wordfence) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1206 (CNA: Wordfence) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1094 (CNA: Wordfence) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1090 (CNA: Wordfence) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L91 (CNA: Wordfence) - https://plugins.svn.wordpress.org/profit-products-tables-for-woocommerce/trunk/index.php (CNA: Wordfence) - https://plugins.trac.wordpress.org/changeset/3784667/profit-products-tables-for-woocommerce/trunk/index.php (CNA: Wordfence) - https://plugins.svn.wordpress.org/profit-products-tables-for-woocommerce/trunk/index.php (security@wordfence.com) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1090 (security@wordfence.com) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1094 (security@wordfence.com) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1206 (security@wordfence.com) - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L91 (security@wordfence.com) - https://plugins.trac.wordpress.org/changeset/3784667/profit-products-tables-for-woocommerce/trunk/index.php (security@wordfence.com) - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4962c61-9059-4fb9-9ddf-5e6aa1d2675a?source=cve (security@wordfence.com) ## Provenance - CNA: Wordfence: https://www.cve.org/CVERecord?id=CVE-2026-120560; retrieved 2026-11-08; source updated 2026-11-08 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120560; retrieved 2026-11-07; source updated 2026-11-07 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-120560; retrieved 2026-11-08; source updated Not reported Revision: 5775050e9b66e75248fb5beb739e99bff1617df2f1abc4bee1c4a2ae3ac4dd6e Canonical: https://y2.dev/cve/CVE-2026-120560 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.