CVE-2026-87831

MEDIUMCVSS 4.3

Description

The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.

Timeline

Published:September 17th, 2026 8:17 AM

Last modified:September 18th, 2026 7:08 PM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/7a871164-ce44-4e4c-8e15-15daa84767c6/

Source: NIST NVD · Data may lag official sources by up to one minute