{"affected":[{"defaultStatus":"unaffected","product":"Checkout Field Editor for WooCommerce (Pro)","source":"CNA: Wordfence","vendor":"Themehigh","versions":[{"lessThanOrEqual":"3.8.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-122041","cwes":["CWE-862"],"description":"The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1794054426721,"publishedAt":1794054426721,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5f2ae-8cd9-4363-9d68-8a59f81a061b?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://www.themehigh.com/product/woocommerce-checkout-field-editor-pro/"}],"remediation":[],"revision":"8844dd8247fe6747a0a9c7e8955692d3c7d498140e20733471b25aa5641e1288","sources":[{"modifiedAt":1794054426721,"name":"CNA: Wordfence","retrievedAt":1794056913106,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122041"}],"ssvc":null,"status":"published","title":"Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action","updatedAt":1794056913106}