The plugins do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack
Requirements: - Enable the “Checkout File Upload” module of the plugin (/wp-admin/admin.php?page=wc-settings&tab;=jetpack&wcj-cat;=dashboard§ion;=all_module) To delete the checkout files from the Order ID 1, Make a logged in shop manager or admin open: https://example.com/wp-admin/?wcj_download_checkout_file_admin_delete_all=1