CVE-2025-13930: WooCommerce Auth Bypass Vulnerability

CVE-2025-13930 Overview

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in versions up to and including 7.8.5. This security flaw stems from the plugin's failure to properly verify user authorization when deleting attachments, combined with flawed guest order ownership validation. The vulnerability allows unauthenticated attackers to delete attachments associated with guest orders using only the publicly available wooccm_upload nonce and attachment ID.

Critical Impact

Unauthenticated attackers can delete arbitrary attachments from guest orders without proper authorization, potentially disrupting e-commerce operations and removing critical order documentation.

Affected Products

• Checkout Field Manager (Checkout Manager) for WooCommerce plugin versions up to and including 7.8.5
• WordPress sites running vulnerable versions of the plugin
• WooCommerce stores accepting guest checkout with file uploads

Discovery Timeline

• 2026-02-19 - CVE CVE-2025-13930 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-13930

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), representing a fundamental access control failure in the plugin's attachment deletion functionality. The plugin exposes an AJAX endpoint for managing uploaded files during the checkout process but fails to implement proper authorization checks before executing deletion operations.

The core issue lies within the class-upload.php file, where the attachment deletion logic does not adequately verify that the requesting user has legitimate ownership or administrative rights over the target attachment. Additionally, the guest order ownership validation mechanism contains logical flaws that can be exploited to bypass the intended access restrictions.

An unauthenticated attacker can leverage the publicly accessible wooccm_upload nonce—which is embedded in the page source for legitimate upload functionality—combined with knowledge of attachment IDs to craft malicious requests that delete files belonging to other users' orders.

Root Cause

The root cause is the absence of proper authorization verification in the attachment deletion handler. The plugin relies on a nonce for CSRF protection but fails to validate that the requesting user has the authority to delete the specified attachment. The guest order ownership validation logic is also flawed, allowing attackers to bypass the intended ownership checks. This represents a classic case of improper access control where authentication tokens are confused with authorization permissions.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can enumerate or guess attachment IDs and then send crafted AJAX requests to the deletion endpoint. The request includes the publicly available wooccm_upload nonce extracted from page source and the target attachment ID. Since the plugin fails to verify proper ownership, the deletion proceeds without authorization.

The attack flow involves extracting the nonce from a WooCommerce checkout page, identifying target attachment IDs through enumeration or other reconnaissance methods, and sending a DELETE request to the AJAX handler with the stolen nonce and target attachment ID. This allows attackers to systematically remove attachments from guest orders across the affected WordPress installation.

Detection Methods for CVE-2025-13930

Indicators of Compromise

• Unusual spikes in AJAX requests targeting wooccm_upload endpoints with deletion parameters
• Missing attachments on guest orders without corresponding administrative deletion logs
• HTTP POST requests containing wooccm_upload action with attachment IDs from unauthenticated sources
• Error logs showing attachment deletion failures or unauthorized access attempts

Detection Strategies

• Monitor WordPress AJAX endpoints for unusual patterns of attachment deletion requests
• Implement logging for all attachment deletions in the WooCommerce checkout flow
• Review web server access logs for suspicious POST requests to /wp-admin/admin-ajax.php containing wooccm_upload actions
• Deploy Web Application Firewall (WAF) rules to detect and block unauthorized attachment manipulation attempts

Monitoring Recommendations

• Enable verbose logging for WooCommerce and the Checkout Field Manager plugin
• Configure alerts for bulk attachment deletions or deletions without corresponding admin sessions
• Monitor for enumeration attempts targeting attachment IDs through sequential request patterns
• Implement file integrity monitoring for the WordPress uploads directory

How to Mitigate CVE-2025-13930

Immediate Actions Required

• Update the Checkout Field Manager (Checkout Manager) for WooCommerce plugin to a version newer than 7.8.5
• Review recent attachment deletions in the WooCommerce order history for suspicious activity
• Consider temporarily disabling the file upload functionality in checkout fields until patched
• Implement additional WAF rules to restrict access to the affected AJAX endpoints

Patch Information

The vulnerability has been addressed in plugin versions released after 7.8.5. Site administrators should update to the latest version immediately. The plugin changeset contains the security fix that implements proper authorization checks for attachment deletion operations. Additional details are available in the Wordfence vulnerability disclosure.

Workarounds

• Disable file upload fields in checkout forms until the plugin can be updated
• Implement server-level access restrictions on the admin-ajax.php endpoint for unauthenticated users
• Use a security plugin or WAF to add additional authorization layers to AJAX endpoints
• Consider removing the plugin temporarily if file uploads are not business-critical

# Example: Restrict admin-ajax.php access via .htaccess
<Files admin-ajax.php>
    <RequireAny>
        Require ip 127.0.0.1
        Require expr %{HTTP_REFERER} =~ m#^https://yourdomain\.com/#
    </RequireAny>
</Files>