Attack Vectors

CVE-2025-13930 affects the WordPress plugin Checkout Field Manager (Checkout Manager) for WooCommerce (slug: woocommerce-checkout-manager) in versions up to and including 7.8.5. The issue is rated Medium severity (CVSS 5.3).

An unauthenticated attacker can target websites using the plugin by leveraging a publicly available wooccm_upload nonce and an attachment ID to request deletion of attachments associated with guest orders. Because no login is required, this is most relevant for stores that accept guest checkout and use the plugin’s upload/attachment features.

Security Weakness

The vulnerability is a missing authorization check combined with flawed guest order ownership validation. In practical terms, the plugin does not reliably verify that the requester is allowed to delete a given attachment, enabling an authorization bypass that can be exploited without authentication.

While the underlying mechanics involve WordPress nonces and attachment identifiers, the business takeaway is straightforward: a public-facing workflow intended for legitimate checkout activity can be misused to remove order-related files when access controls are not enforced correctly.

Technical or Business Impacts

Operational disruption: Deleted attachments can impact order handling, customer service, and fulfillment workflows if teams rely on uploaded documents (for example, supporting files tied to guest orders).

Compliance and audit risk: If attachments are used to support regulated processes (documentation retention, dispute handling, or contractual records), deletion can create gaps in recordkeeping and complicate audit readiness.

Brand and revenue impact: Missing order files can increase support volume, slow delivery timelines, and harm customer trust—especially if high-value orders require documentation.

Risk scope: The published CVSS vector indicates no confidentiality impact and a limited integrity impact (I:L), aligning with the primary consequence of unauthorized deletion rather than data exposure.

Remediation: Update Checkout Field Manager (Checkout Manager) for WooCommerce to version 7.8.6 or newer (patched). Source: Wordfence vulnerability record. CVE record: CVE-2025-13930.

Similar Attacks

Authorization weaknesses in web applications and plugins are commonly exploited to perform actions the attacker should not be allowed to take (including deleting or modifying content). For context, here are real, widely documented examples of web authorization failures and their consequences:

Uber (2016) security incident disclosure
Imperva overview: Broken Access Control
OWASP Top 10: Broken Access Control (A01:2021)