CVE-2025-13930

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13930", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-02T21:35:39.501Z", "datePublished": "2026-02-19T04:36:08.678Z", "dateUpdated": "2026-04-08T16:45:27.242Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:27.242Z"}, "affected": [{"vendor": "quadlayers", "product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.8.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8.5. This is due to the plugin not properly verifying that a user is authorized to delete an attachment combined with flawed guest order ownership validation. This makes it possible for unauthenticated attackers to delete attachments associated with guest orders using only the publicly available wooccm_upload nonce and attachment ID."}], "title": "Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33486414-6878-4b16-ae2d-00ec52fc2213?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.1/lib/class-upload.php#L114"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.1/lib/class-upload.php#L75"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440979%40woocommerce-checkout-manager&new=3440979%40woocommerce-checkout-manager&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "NosleeP"}], "timeline": [{"time": "2026-02-18T16:06:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:22:58.435972Z", "id": "CVE-2025-13930", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:38:45.402Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13930", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:22:58.435972Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:22:59.820Z"}}], "cna": {"title": "Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion", "credits": [{"lang": "en", "type": "finder", "value": "NosleeP"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "quadlayers", "product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.8.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T16:06:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33486414-6878-4b16-ae2d-00ec52fc2213?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.1/lib/class-upload.php#L114"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.1/lib/class-upload.php#L75"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440979%40woocommerce-checkout-manager&new=3440979%40woocommerce-checkout-manager&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8.5. This is due to the plugin not properly verifying that a user is authorized to delete an attachment combined with flawed guest order ownership validation. This makes it possible for unauthenticated attackers to delete attachments associated with guest orders using only the publicly available wooccm_upload nonce and attachment ID."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:27.242Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13930", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:27.242Z", "dateReserved": "2025-12-02T21:35:39.501Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:08.678Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "vendor": "quadlayers", "versions": [{"lessThanOrEqual": "7.8.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8.5. This is due to the plugin not properly verifying that a user is authorized to delete an attachment combined with flawed guest order ownership validation. This makes it possible for unauthenticated attackers to delete attachments associated with guest orders using only the publicly available wooccm_upload nonce and attachment ID."}, {"lang": "es", "value": "El plugin Checkout Field Manager (Checkout Manager) para WooCommerce para WordPress es vulnerable a un bypass de autorizaci\u00f3n en versiones hasta la 7.8.5, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para eliminar un archivo adjunto, combinado con una validaci\u00f3n defectuosa de la propiedad de pedidos de invitados. Esto hace posible que atacantes no autenticados eliminen archivos adjuntos asociados con pedidos de invitados utilizando solo el nonce wooccm_upload disponible p\u00fablicamente y el ID del archivo adjunto."}], "id": "CVE-2025-13930", "lastModified": "2026-06-17T08:35:00.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13930", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:22:58.435972Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:33.790", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.1/lib/class-upload.php#L114"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.1/lib/class-upload.php#L75"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440979%40woocommerce-checkout-manager&new=3440979%40woocommerce-checkout-manager&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33486414-6878-4b16-ae2d-00ec52fc2213?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.8.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "source": "cna", "vendor": "quadlayers"}, "product": "checkout_field_manager_(checkout_manager)_for_woocommerce", "vendor": "quadlayers"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T23:44:42.228268+00:00", "value": {"mitigation_remediation": ["Upgrade the Checkout Field Manager plugin to any version newer than 7.8.5", "Disable or uninstall the Checkout Field Manager plugin if it is not required for site functionality", "Restrict WordPress upload permissions so that only authenticated users can delete attachments and monitor upload logs for suspicious deletion activity"], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Deletion of Attachments"}, "threat_synthesis": {"affected_systems": "All WordPress sites running Checkout Field Manager (Checkout Manager) for WooCommerce versions up to and including 7.8.5 are affected. The vulnerability is triggered by any installation that has not been updated to a version newer than 7.8.5.", "description_and_impact": "The Checkout Field Manager (Checkout Manager) for WooCommerce plugin suffers from an authorization bypass that lets unauthenticated users delete any attachment tied to a guest order. Because the plugin does not correctly verify the user's rights before performing the delete operation, an attacker can use a publicly available wooccm_upload nonce and the ID of a target attachment to erase files from the site. This loss of data can compromise the integrity of order records and undermine customer trust, especially when the removed attachments are essential to order fulfillment.", "risk_and_exploitability": "With a CVSS base score of 5.3 the flaw is considered moderate. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA KEV. However, the required parameters for exploitation \u2013 a valid nonce and attachment ID \u2013 are publicly available, making the attack path straightforward for an adversary who can obtain or guess them. The impact is permanent data loss, as deleted attachments are not automatically recovered."}}}}, "created": "2026-02-19T10:07:20.122791+00:00", "updated": "2026-04-21T23:45:02.988962+00:00", "vendors": ["quadlayers", "quadlayers$PRODUCT$checkout_field_manager_(checkout_manager)_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}