WordPress Plugin Vulnerabilities

Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field

Description

The plugin does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.

Proof of Concept

Affects Plugins

Plugin icon
woocommerce-checkout-manager
Fixed in 7.9.7

References

CVE
CVE-2026-87831

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
Submitter
Md. Moniruzzaman Prodhan (NomanProdhan)
Submitter website
https://nomanprodhan.com
Submitter twitter
nomanprodhan
Verified
Yes
WPVDB ID
7a871164-ce44-4e4c-8e15-15daa84767c6

Timeline

Publicly Published
2026-09-17 (about 9 hours ago)
Added
2026-09-17 (about 1 hour ago)
Last Updated
2026-09-17 (about 1 hour ago)

Other

Published
Title
Published
2024-05-21
Title
UserPro < 5.1.9 - Unauthenticated Account Takeover to Privilege Escalation
Published
2026-08-13
Title
ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload
Published
2021-04-06
Title
WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update
Published
2026-08-24
Title
WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR
Published
2023-06-02
Title
VK Blocks < 1.58.0.0 - Contributor+ Settings Update via REST API