Themehigh has fixed a critical missing-authorization flaw in its paid Checkout Field Editor for WooCommerce plugin. Where a file-upload field is configured at checkout, anyone on the internet can delete media from the site without logging in.
What happened
The vulnerability is CVE-2026-122041, scored 9.1, affecting versions up to and including 3.8.0 and fixed in 3.8.1. The AJAX handler thwcfe_remove_uploaded is registered for logged-out requests as well as logged-in ones, and its only check is a nonce the plugin prints into the public checkout page markup whenever a File Upload field exists.
Because the handler never verifies that the caller owns the attachment, a crafted attachment_id removes any item in the media library, including files belonging to other users and other posts. The CVSS vector marks confidentiality as unaffected with high integrity and availability impact, which fits a flaw that destroys data rather than reading it.
It is not the plugin's first bug of this shape: version 3.6.2 carried a 9.8 for unauthenticated arbitrary file deletion. No in-the-wild exploitation has been reported for this one.
Who is affected
WooCommerce stores on the paid Pro edition at 3.8.0 or earlier that have a File Upload checkout field, the usual pattern for proof-of-payment, identity documents or artwork uploads.
- Stores that collect payment proof or documents during checkout
- Sites where checkout pages are public, which is every store
- Any install where plugin versions are not inventoried and updated centrally
What to do now
Update to 3.8.1 or later, then check whether the media library is still intact.
- Update the plugin from the Themehigh account or your plugin manager, and confirm 3.8.1 is what is running.
- If you cannot update immediately, remove the File Upload field from checkout: without that field the nonce this handler relies on is not published.
- Compare the media library against your most recent backup and restore anything missing.
- Add the plugin to the monthly check you run for WooCommerce and your other paid add-ons.
What this means for South African businesses
Paid plugins get less scrutiny than the ones in the wordpress.org directory, and this one has now shipped two unauthenticated file-deletion flaws. For a small store the damage is broken product images, missing invoices and a checkout that quietly stops working, which costs sales long before anyone calls it a security incident. My judgement: the effort for an attacker is close to zero and the miss is easy for an owner, so this belongs on the routine update list rather than the emergency one.
Source: Wordfence Intelligence advisory for CVE-2026-122041.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.