The Checkout Field Manager plugin for WooCommerce contains an authorization bypass that allows an authenticated user with subscriber-level role or higher to delete any Media Library attachment. The plugin does not correctly verify authorisation when a deletion request is received, enabling removal of arbitrary media files. This can compromise site integrity and cause loss of media assets. The flaw is identified as CWE-862, "Missing Authorization for Operations."

Any WordPress site running the Checkout Field Manager plugin, version 7.9.6 or earlier, is affected. Sites that have this plugin installed and have subscriber or higher level accounts are at risk because those users can execute the deletion action.

The vulnerability has a CVSS score of 8.1, indicating high severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. An attacker only needs an authenticated subscriber account to exploit the issue; no additional privileges or user interaction beyond the normal checkout process are required. Once authenticated, the attacker can supply an attachment ID to delete any media item stored on the site.