Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

WooCommerce Checkout Manager plugin allows attackers to upload files without login

CVE-2025-12500 · published 8 months ago
Summary

The WooCommerce Checkout Manager plugin, used with WordPress, has a security flaw that lets attackers upload files to the server without needing a login. This means an attacker could potentially upload malicious files, although the types of files they can upload are limited. To stay safe, update the plugin to the latest version or remove it if you don't need it.

Original advisory text
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to t...
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the "ajax_checkout_attachment_upload" function. This makes it possible for unauthenticated attackers to upload files to the server, though file types are limited to WordPress's default allowed MIME types (images, documents, etc.).
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published19 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-12500 · NVD
Track software like this
Free during beta