Executive brief
The Checkout Field Manager (Checkout Manager) plugin for WooCommerce allows any authenticated user, including customers, to delete media attachments without proper ownership validation. An attacker with a basic customer account can delete arbitrary media files uploaded by other users, causing data loss and operational disruption to website content.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability classified as CWE-639 (Authorization of Functionality Based on Down-Level Data). The plugin fails to validate attachment ownership before processing deletion requests, allowing any authenticated user to delete media belonging to other users by manipulating attachment IDs. The vulnerability requires user authentication but no elevated privileges—any customer-level account can exploit it. An attacker can delete arbitrary media attachments from the WordPress Media Library, leading to loss of customer-facing content, product images, or internal documentation. The vulnerability is fixed in version 7.9.7 and later.
Affected products
- WooCommerce Checkout Field Manager before 7.9.7
Timeline
- 2026-09-17: disclosed: CVE-2026-87829 published
- 2026-09-17: patched: Fixed in version 7.9.7