CVE-2026-122041: Unauthorized deletion of attachments in WooCommerce plugin
This text was generated using artificial intelligence (AI).CVE-2026-122041 affects the WordPress plugin Checkout Field Editor for WooCommerce (Pro) from Themehigh up to and including version 3.8.0. The vulnerability allows unauthenticated attackers to delete arbitrary media attachments. According to Wordfence, the CNA rates the vulnerability with a CVSS score of 9.1.
Themehigh released version 3.8.1 as a patched version on November 3, 2026. Affected installations should check their patch status and update.
The cause lies in the function ajax_remove_uploaded. This processes requests to delete uploaded files without performing a permission or ownership check for the requested attachment.
The affected handler is registered for both authenticated and unauthenticated access. The protection mechanism is the nonce value file_handling_nonce. This value is output in the public checkout markup when a file upload field is configured in the checkout.
This allows unauthenticated attackers to send a crafted request with an attachment ID. The vulnerability can allow the deletion of attachments that are associated with other users or posts. According to Wordfence, this may lead to data loss and an impact on availability.
The CVSS vector indicates that the vulnerability does not compromise confidentiality (C:N) — data cannot be intercepted. The high values for integrity and availability (I:H/A:H) reflect that attachments can be irretrievably deleted and checkout processes can be disrupted.
Wordfence does not report any active exploitation for CVE-2026-122041. The lack of reporting an active exploitation does not change the priority for affected shop installations: The vulnerability is relevant through the publicly accessible checkout if a file upload field is configured.
Actions for affected shop installations
Patch verification and updates take priority. For installations up to and including version 3.8.0, the following steps apply:
Match the plugin version with the affected version range.
Update the plugin to version 3.8.1 or higher.
Prioritize and mitigate affected systems.
Disable file upload checkout fields if an immediate update is not possible.
Establish continuous vulnerability and vendor risk monitoring for deployed components.
Temporarily disabling file upload checkout fields limits the public availability of the relevant nonce value. It is a short-term measure and does not replace updating to the fixed version.
WooCommerce operators in the EU, particularly in Germany and Austria, should check whether data loss or availability impairment caused by the vulnerability affects personal data. In this case, a reporting obligation under Art. 33 GDPR (72-hour deadline to the relevant data protection authority) may apply. For NIS-2 obligated digital service providers in Germany and Austria, additional reporting requirements apply for significant security incidents; in Switzerland, the revised Information Security Act (ISG) governs corresponding reporting obligations to BACS.
Visibility of publicly accessible shop components with LocateRisk
CVE-2026-122041 demonstrates why the visibility of publicly accessible shop components is relevant for technical prioritization. The affected plugin is deployed under the customer domain and is reachable via the public checkout endpoint.
LocateRisk can identify WooCommerce instances under customer domains as well as exposed WordPress plugins. This allows for capturing publicly accessible shop instances for patch and impact verification. However, the visibility of deployed software does not necessarily prove the specifically vulnerable plugin version. Version and patch verification remain necessary.
For organizations with multiple web presences, shops, or externally operated components, this visibility supports the classification of which publicly accessible systems should be checked in connection with a known vulnerability. LocateRisk is Made in Germany, operates exclusively in German data centers, and was designed in accordance with GDPR requirements.
Am I affected?
Affected is Checkout Field Editor for WooCommerce in the versions mentioned above; the vulnerability was fixed in 3.8.1. Anyone who wants to know whether Checkout Field Editor for WooCommerce is visible in their own externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-122041 allows unauthenticated attackers to delete arbitrary media attachments in an affected WordPress installation — including attachments associated with other users or posts. This can lead to data loss and an impairment of the checkout operation. Confidential data cannot be harvested through this vulnerability.
This affects all versions of the plugin Checkout Field Editor for WooCommerce (Pro) up to and including version 3.8.0. Themehigh provided version 3.8.1 on November 3, 2026, as a fixed version.
The recommended action is to immediately update to version 3.8.1 or higher. As a short-term workaround, the file upload checkout field can be disabled, as this will prevent the relevant nonce value from being output in the public checkout markup. This action does not replace the update.
As of November 07, 2026. This article is for general informational purposes only and is not legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always decisive. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-122041
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français