Checkout Field Manager CVE-2026-17031

The attacker must hold an authenticated WordPress account at subscriber level or above on a site where the Checkout Field Manager (Checkout Manager) for WooCommerce plugin (version ≤ 7.9.6) is installed and active. No non-default plugin configuration is required - the missing authorization check is present by default. The chief limiting factor is the need for a valid low-privilege login; however, WooCommerce storefronts very commonly enable self-service customer/subscriber registration, which lets an attacker create the required account at will, substantially weakening this limitation. Impact is bounded to deletion of Media Library attachments (no read access to confidential data), so a defender's realistic concern is content defacement and data loss rather than full compromise.

This is a genuine prioritization candidate for any WooCommerce store running this plugin, though not a top-tier emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction - consistent with the description's 'subscriber-level access and above.' Because WooCommerce storefronts routinely enable open customer/subscriber registration, the PR:L barrier is often trivially satisfied, effectively lowering the practical bar toward unauthenticated-equivalent. However, several real-risk signals are MISSING: no EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so exploitation probability cannot be quantified from the input. The impact is also narrower than the 8.1 suggests to a casual reader - C:N means no data disclosure; the harm is deletion of arbitrary Media Library attachments (integrity/availability destruction), which can deface a store or cause data loss but does not grant site takeover. Net: real patch priority for affected stores given the low privilege requirement and clean patch path, but this is a data-destruction authorization flaw, not a code-execution or account-takeover bug, and the absence of EPSS/KEV/POC data means active-exploitation risk is currently unestablished rather than confirmed low.

An attacker registers a free customer/subscriber account on a WooCommerce store running the vulnerable plugin (or uses any existing low-privilege login). They then invoke the plugin's unprotected delete action against Media Library attachment IDs, deleting product images, uploaded files, or other media across the entire site without any administrative authorization. No public exploit code is identified at time of analysis, but the missing authorization check makes the action straightforward to script.