External risk intelligence

Checkout Field Editor for WooCommerce Pro Attachment Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-122041

The vulnerability exists in a WordPress plugin used for WooCommerce checkout processes. Checkout pages are public-facing web components by design, and the affected AJAX handler is intentionally exposed to handle file uploads during the checkout flow, making it reachable from the public internet.

Denial of Service

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular WordPress plugin that extends WooCommerce checkout functionality. The issue allows for the deletion of uploaded files without proper authorization, potentially leading to the loss of important media and service disruptions. This affects the plugin's handling of file uploads during the checkout process.

Unauthorized file deletion in checkout.
Matters for data integrity and service availability.
Confirm plugin relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can leverage a vulnerability in a WooCommerce checkout plugin to delete arbitrary files. This is possible because the plugin fails to adequately check user permissions or ownership before processing file removal requests. By submitting a specially crafted request, an attacker can trigger the deletion of attachments, potentially leading to data loss and denial of service.

Vulnerable plugin exposed on public checkout page.
Missing permission checks in file removal function.
Risk of unauthorized deletion and denial of service.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could delete arbitrary attachments on a WordPress site, potentially leading to the loss of important media files and a denial of service. This is possible because the affected function lacks proper checks to verify user authorization and ownership of the files targeted for deletion.

Arbitrary attachment deletion.
Unauthenticated requests to a public endpoint.
Loss of media and denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Checkout Field Editor for WooCommerce (Pro) plugin, a component likely managed by the Application Owner or Platform Team responsible for the WooCommerce storefront. The first practical step is to identify all WordPress instances using this plugin, determine if the affected AJAX endpoint is exposed externally, and confirm the business criticality of the affected functionality. This will help prioritize remediation efforts and identify the accountable owner.

Application owners should own the issue.
Verify external reachability of the AJAX handler.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Checkout Field Editor for WooCommerce (Pro) plugin?

It is a WordPress plugin designed to customize the checkout process in WooCommerce stores. Store administrators use it to add, edit, or remove fields, including file upload inputs, to collect specific customer information during purchase. Because it operates within the e-commerce checkout flow, it is a core functional component for many online storefronts.

What does CVE-2026-122041 mean for security?

This vulnerability is classified as CWE-862, or Missing Authorization. In simple terms, the plugin fails to verify if a user has the right to delete a file before performing the action. Because the software lacks this check, a user can instruct the system to remove media files from the server, even if they do not own those files or have administrative privileges.

How does an attacker trigger this vulnerability?

An attacker targets the ajax_remove_uploaded() function, which the plugin exposes to process file removals. The flaw is triggered by sending a request containing a crafted attachment ID to this function. It is important to note that simply visiting a checkout page does not trigger this; the attacker must deliberately submit a specific request to the vulnerable AJAX handler to delete files.

Is my site at risk according to Halo Surface Signal?

The risk is elevated because the affected AJAX handler is intentionally designed to be reachable from the public internet. Since WooCommerce checkout pages are inherently public-facing web components, an attacker does not need special network access to reach the vulnerable endpoint. If your site uses this plugin and has file upload fields configured, your site is likely reachable.

What should I do if I run this WooCommerce plugin?

First, conduct an inventory of your WordPress instances to identify where this specific plugin version is active. Once identified, evaluate whether you have File Upload fields enabled in your checkout settings, as these configurations make the vulnerable code path accessible. Coordinate with your application team to plan for updates or temporary configuration changes during a scheduled maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.