CVE-2026-17031
8.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-862
Impact
Authenticated users with at least subscriber-level access can permanently delete arbitrary attachments from the WordPress Media Library. They only need standard network access and a low-privileged account.
Root cause
The plugin fails to properly verify user authorization before handling media attachment deletion requests.
Affected systems
Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress up to, and including, 7.9.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Fix & remediation
Upgrade the plugin to version 7.9.7 or higher. If patching must wait, disable the Checkout Field Manager plugin entirely or revoke subscriber-level account access.
$ wp plugin update woocommerce-checkout-managerAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.