CVE-2025-13930

The WooCommerce Checkout Field Manager plugin has a security issue affecting versions up to 7.8.5, allowing unauthorized users to remove file attachments linked to guest orders by exploiting a weakness in access controls and order ownership verification. This vulnerability stems from the plugin's failure to ensure that only authorized individuals can delete attachments. As a result, unauthenticated attackers can use publicly accessible security tokens to delete these files.

Based on public CVE data (MITRE/NVD).