CVE-2019-11807

The WooCommerce Checkout Manager plugin prior to version 4.3 contains a vulnerability that permits unauthenticated users to delete media files through the admin-ajax.php endpoint. The flaw stems from improper capability validation combined with the registration of an action accessible to non-privileged users, allowing attackers to remove attachments by manipulating the wccm_default_keys_load parameter in requests to update_attachment_wccm.

Based on public CVE data (MITRE/NVD).