CVE-2026-122041 The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122041?
CVE-2026-122041 is a critical vulnerability in Themehigh Checkout Field Editor for WooCommerce (Pro), published on 7 Nov 2026.
Official description
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
Weakness: CWE-862
Which versions are affected by CVE-2026-122041?
How do I fix CVE-2026-122041?
No fix has been published for CVE-2026-122041 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122041 being exploited?
There is no known exploitation of CVE-2026-122041 in the wild and no public exploit code.
Sources
Also known as GHSA-98xv-x2q6-m2xg.