CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajaxremoveuploaded function in versions up to, and including, 3.8.0. The handler is registered for both wpajax and...

CVE-2026-122041

The Checkout Field Editor for WooCommerce (Pro) WordPress plugin (versions