What is CVE-2026-122041?

CVE-2026-122041 is a critical-severity vulnerability in Themehigh Checkout Field Editor For Woocommerce (Pro), classified under Missing Authorization. CVSS score: 9.1/10. Published 2026-11-07.

How severe is CVE-2026-122041?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Auth bypass in Themehigh Checkout Field Editor For Woocommerce (Pro)

CVE-2026-122041

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.

Vulnerability class: Broken Access Control

Published 2026-11-07 · last modified 2026-11-07.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Themehigh Checkout Field Editor For Woocommerce (Pro)

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2026-122041?: CVE-2026-122041 is a critical-severity vulnerability in Themehigh Checkout Field Editor For Woocommerce (Pro), classified under Missing Authorization. CVSS score: 9.1/10. Published 2026-11-07.
How severe is CVE-2026-122041?: Critical severity. CVSS v3 base score is 9.1 out of 10.