CVE-2025-13930: 
WordPress vulnerability analysis and mitigation

CVE-2025-13930 is an authorization bypass vulnerability in the Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress. It affects all versions up to and including 7.8.5, allowing unauthenticated attackers to delete attachments associated with guest orders by exploiting improper authorization checks combined with flawed guest order ownership validation. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The plugin fails to properly verify that a requesting user is authorized to delete an attachment, and its guest order ownership validation is flawed, allowing any unauthenticated network user to perform the deletion action. An attacker only needs the publicly available wooccm_upload nonce and the target attachment ID — both of which may be obtainable through normal interaction with a WooCommerce guest checkout flow — to trigger the unauthorized deletion (Red Hat CVE).

Successful exploitation allows unauthenticated attackers to delete file attachments associated with guest orders on affected WooCommerce stores, resulting in a low integrity impact with no confidentiality or availability consequences. This could disrupt order processing workflows, destroy customer-submitted documents (e.g., custom order files or proofs), and undermine the reliability of the checkout process for merchants relying on the plugin (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13930 at this time. The EPSS score is approximately 0.045%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only network access and knowledge of the publicly available nonce, making it relatively low-effort for a motivated attacker targeting guest-order-enabled WooCommerce stores (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Checkout Field Manager (Checkout Manager) for WooCommerce plugin version 7.8.5 or earlier, using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain the nonce: Complete or observe a guest checkout flow on the target site to capture the publicly exposed wooccm_upload nonce value from the page or network requests.
3. Identify attachment IDs: Enumerate or guess attachment IDs associated with guest orders (e.g., by observing upload responses or incrementing IDs).
4. Send deletion request: Craft and send an unauthenticated HTTP request to the plugin's attachment deletion endpoint, supplying the captured wooccm_upload nonce and the target attachment ID, bypassing authorization checks.
5. Confirm deletion: Verify that the targeted attachment has been removed from the guest order, achieving unauthorized data destruction (Red Hat CVE).

• Network: Unusual unauthenticated POST or GET requests to WooCommerce/plugin endpoints handling attachment deletion (e.g., admin-ajax.php with actions related to wooccm), originating from unexpected or repeated IP addresses.
• Logs: WordPress or web server access logs showing repeated requests to attachment deletion endpoints with the wooccm_upload nonce parameter from unauthenticated sessions.
• File System: Missing or unexpectedly deleted attachment files in the WordPress uploads directory associated with WooCommerce guest orders.
• Application: Guest orders in WooCommerce admin showing missing or deleted attachments without corresponding authenticated user actions in the audit log.

Users should update the Checkout Field Manager (Checkout Manager) for WooCommerce plugin to a version beyond 7.8.5 that addresses the authorization bypass. If an updated version is not yet available, consider temporarily disabling the plugin's file attachment functionality or restricting access to the affected endpoints via web application firewall (WAF) rules. Monitor the WordPress plugin repository and vendor communications for a patched release (Red Hat CVE).