The Checkout Field Manager (Checkout Manager) for WooCommerce plugin suffers from an authorization bypass that lets unauthenticated users delete any attachment tied to a guest order. Because the plugin does not correctly verify the user's rights before performing the delete operation, an attacker can use a publicly available wooccm_upload nonce and the ID of a target attachment to erase files from the site. This loss of data can compromise the integrity of order records and undermine customer trust, especially when the removed attachments are essential to order fulfillment.

All WordPress sites running Checkout Field Manager (Checkout Manager) for WooCommerce versions up to and including 7.8.5 are affected. The vulnerability is triggered by any installation that has not been updated to a version newer than 7.8.5.

With a CVSS base score of 5.3 the flaw is considered moderate. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA KEV. However, the required parameters for exploitation – a valid nonce and attachment ID – are publicly available, making the attack path straightforward for an adversary who can obtain or guess them. The impact is permanent data loss, as deleted attachments are not automatically recovered.