Checkout Field Manager Checkout Manager For Woocommerce
Monthly
Authenticated users, including a self-registered WooCommerce customer, can delete arbitrary media attachments belonging to other users on WordPress sites running the Checkout Field Manager (Checkout Manager) for WooCommerce plugin before version 7.9.7, because the plugin fails to verify attachment ownership before performing the delete. The flaw is a broken-authorization (CWE-862/IDOR) issue rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning the impact is limited to integrity of file data with no confidentiality loss or code execution, but any low-privilege account - not necessarily an administrator - is sufficient. Publicly available exploit code exists per the WPScan disclosure, and there is no confirmed active exploitation (CISA KEV); remediation is a straightforward upgrade to 7.9.7 or later.
Arbitrary media-attachment deletion in the Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before version 7.9.7 lets any authenticated user - including a self-registered customer account - delete media attachments that belong to other users, because the plugin fails to verify ownership of the attachment before acting on it. The flaw is a classic IDOR (CWE-639) with limited impact: integrity only, no data disclosure, no remote code execution, and no site-wide outage, which is why the CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (published via WPScan), and no CISA KEV entry indicates confirmed active exploitation, but the low bar for exploitation on WooCommerce stores with default open customer registration means the practical risk is higher than the numeric score alone suggests.
Authenticated users, including a self-registered WooCommerce customer, can delete arbitrary media attachments belonging to other users on WordPress sites running the Checkout Field Manager (Checkout Manager) for WooCommerce plugin before version 7.9.7, because the plugin fails to verify attachment ownership before performing the delete. The flaw is a broken-authorization (CWE-862/IDOR) issue rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning the impact is limited to integrity of file data with no confidentiality loss or code execution, but any low-privilege account - not necessarily an administrator - is sufficient. Publicly available exploit code exists per the WPScan disclosure, and there is no confirmed active exploitation (CISA KEV); remediation is a straightforward upgrade to 7.9.7 or later.
Arbitrary media-attachment deletion in the Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before version 7.9.7 lets any authenticated user - including a self-registered customer account - delete media attachments that belong to other users, because the plugin fails to verify ownership of the attachment before acting on it. The flaw is a classic IDOR (CWE-639) with limited impact: integrity only, no data disclosure, no remote code execution, and no site-wide outage, which is why the CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (published via WPScan), and no CISA KEV entry indicates confirmed active exploitation, but the low bar for exploitation on WooCommerce stores with default open customer registration means the practical risk is higher than the numeric score alone suggests.