Read the docs
TI-2026-74596 Aliases CVE-2026-17031GHSA-mfhh-qmgc-7465

WooCommerce Checkout Field Manager: Missing Authorization Allows Media Deletion

Priority LOW 35CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress does not verify that a user is authorized to perform an action in versions up to and including 7.9.6. An authenticated attacker with Subscriber-level access or higher can delete arbitrary Media Library attachments. The CNA rates this CWE-862 Missing Authorization issue 8.1 (HIGH) under CVSS 3.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quadlayersCheckout Field Manager (Checkout Manager) for WooCommerceup to 7.9.6—No fix listedCNA
  • Checkout Field Manager (Checkout Manager) for WooCommerce Vendorquadlayers Affected up to 7.9.6 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for this plugin, and the affected range runs up to and including 7.9.6. Until a fix is released, limit or remove Subscriber-level accounts on affected sites, or deactivate the plugin.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-17031
  2. 2026-10-16 Alias added: GHSA-mfhh-qmgc-7465
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2021-03299 WordPress Mega Menu <= 2.0.6 - Arbitrary File Creation CVSS 3.1CRITICAL 9.8
  • TI-2023-25819 WordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2019-11850 The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for… CVSS 3.0HIGH 8.8
  • TI-2025-36354 WordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
  • TI-2024-26564 WordPress Social Feed Gallery plugin <= 4.3.9 - Broken Access Control vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2022-07945 WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Server Information Exposure vulnerability CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences