CVE-2026-87829
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
| CWE | CWE-639 |
| Vendor | unknown |
| Product | checkout field manager (checkout manager) for woocommerce |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown checkout field manager (checkout manager) for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown checkout field manager (checkout manager) for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Checkout Field Manager (Checkout Manager) for WooCommerce
7.8.6 < 7.9.7
References
Credits
PO-WEI TING (Dinlon5566) Open Information Security Inc. WPScan