CVE-2019-11807

Published: May 6, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_default_keys_load parameter because of a nopriv_ registration and a lack of capabilities checks.

Affected (1)

Products: Visser: Woocommerce Checkout Manager

1 product

Woocommerce Checkout Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Visser Woocommerce Checkout Manager	Before 4.3

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://wpvulndb.com/vulnerabilities/9262

Source: cve@mitre.org

https://www.wordfence.com/blog/2019/05/unauthenticated-media-deletion-vulnerability-patched-in-woocommerce-checkout-manager-plugin/

Source: cve@mitre.org

ExploitThird Party Advisory

https://wpvulndb.com/vulnerabilities/9262

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.wordfence.com/blog/2019/05/unauthenticated-media-deletion-vulnerability-patched-in-woocommerce-checkout-manager-plugin/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.