The vulnerability exists in the Checkout Field Manager WordPress plugin for WooCommerce before version 7.9.7, where an authenticated user can delete any media attachment without verifying ownership. This flaw allows a customer or other logged‑in user to remove files belonging to other users, leading to loss of information and potential disruption of store operations. The weakness is classified as an improper authorization control (CWE-639).

WooCommerce sites running Checkout Field Manager (Checkout Manager) WordPress plugin with versions older than 7.9.7. Any site using this plugin without an updated patch is susceptible.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated; thus any user with a valid account can target attachments they should not own. No additional prerequisites such as network reachability are required beyond standard authenticated access to the WordPress admin area.