PLUGIN SECURITY
Is Woocommerce Checkout Manager safe?
Checkout Field Manager (Checkout Manager) for WooCommerce is the most advanced plugin to customize checkout fields on your WooCommerce checkout page.
What this plugin does
- Slug:
woocommerce-checkout-manager - Author: quadlayers
- 80000+ active installs
- 90/100 rating (784 reviews on wordpress.org)
- 6815480 all-time downloads
- On WordPress.org since 2013-05-22
checkout editorcheckout field customizercheckout fieldscheckout managerWooCommerce checkout
Maintenance status
- Latest known version: 7.9.5
- Last updated: 2026-09-30 10:43am GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 5.6+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
7 known CVEs on file for Woocommerce Checkout Manager. Reported between 2019 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-87831 | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.9.7 | Missing Authorization | Medium 4.3 | < 7.9.7 | 7.9.7 | 2026-09-17 | ⚠ update needed |
| CVE-2026-87829 | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.9.7 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 7.9.7 | 7.9.7 | 2026-09-17 | ⚠ update needed |
| CVE-2026-17031 | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.9.7 | Missing Authorization | High 8.1 | < 7.9.7 | 7.9.7 | 2026-09-17 | ⚠ update needed |
| CVE-2025-12500 | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.8.2 | Unrestricted Upload of File with Dangerous Type | Medium 5.3 | < 7.8.2 | 7.8.2 | 2026-02-18 | ✓ fixed in latest |
| CVE-2025-13930 | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.8.6 | Missing Authorization | Medium 5.3 | < 7.8.6 | 7.8.6 | 2026-02-18 | ✓ fixed in latest |
| CVE-2023-47681 | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 7.3.1 | Missing Authorization | Medium 6.5 | < 7.3.1 | 7.3.1 | 2023-11-09 | ✓ fixed in latest |
| — | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 5.5.7 | — | Unknown | < 5.5.7 | 5.5.7 | 2022-06-14 | ✓ fixed in latest |
| — | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 5.5.7 | — | Unknown | < 5.5.7 | 5.5.7 | 2022-06-14 | ✓ fixed in latest |
+ 4 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 4.2.7 | — | Unknown | < 4.2.7 | 4.2.7 | 2019-04-26 | ✓ fixed in latest |
| CVE-2019-11807 | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 4.3 | Unrestricted Upload of File with Dangerous Type | High 7.5 | < 4.3 | 4.3 | 2019-04-25 | ✓ fixed in latest |
| — | Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager] < 5.5.7 | — | Unknown | < 5.5.7 | 5.5.7 | — | ✓ fixed in latest |
| — | Checkout Fields Manager for WooCommerce < 5.5.7 - Reflected Cross-Site Scripting | — | Unknown | < 5.5.7 | 5.5.7 | — | ✓ fixed in latest |
How to fix it
Keep Woocommerce Checkout Manager updated — 7.9.5 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager — 80000+ active installs — 94/100 (296) — max PHP 8.4
- Checkout Field Editor for WooCommerce – Checkout Manager — 20000+ active installs — 98/100 (165) — max PHP 8.4
- Checkout Fields for Blocks — 1000+ active installs — 88/100 (9) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.