CVE-2026-122041 is a critical (CVSS 9.1) missing-authorization flaw in Themehigh's Checkout Field Editor for WooCommerce (Pro) WordPress plugin, through version 3.8.0, that lets unauthenticated attackers delete arbitrary media attachments.
What Is It
The flaw is in the plugin's ajax_remove_uploaded() function. That function does not check the caller's capabilities or whether they own the file (CWE-862: Missing Authorization). The handler is registered under both wp_ajax and wp_ajax_nopriv, so logged-out visitors can call it too. Its only protection is the file_handling_nonce nonce. That nonce is printed in the public checkout page markup as a data-nonce attribute whenever a File Upload checkout field is configured.
An unauthenticated attacker can read the nonce from the checkout page, then send a crafted attachment_id to delete any attachment on the site, including files that belong to other users or posts.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The attack works over the network, is low-complexity, and needs no privileges or user interaction. There is no confidentiality impact, but integrity and availability impacts are both rated High. Successful exploitation can destroy important media and may cause denial of service on affected WooCommerce stores.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation has not been confirmed by KEV at the time of writing. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: Themehigh
- Product: Checkout Field Editor for WooCommerce (Pro), a WordPress plugin
- Affected versions: all versions up to and including 3.8.0
- Exposure condition: the nonce is only exposed when a File Upload checkout field is configured, which puts it in the public checkout page markup
Patch Status
The supplied NVD record lists versions up to and including 3.8.0 as affected but does not name a fixed version. Since there is no KEV entry, there is no CISA-mandated required action or due date. Administrators should:
- Check the vendor product page and the Wordfence advisory for an updated release.
- Upgrade past 3.8.0 once a fix is confirmed.
- Until then, consider whether File Upload checkout fields need to stay enabled, since they are what expose the nonce.