CVE-2025-12500

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the "ajax_checkout_attachment_upload" function. This makes it possible for unauthenticated attackers to upload files to the server, though file types are limited to WordPress's default allowed MIME types (images, documents, etc.).

• CWE-434

• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L143
• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L19
• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L30
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3404371%40woocommerce-checkout-manager&new=3404371%40woocommerce-checkout-manager&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e807480b-00c9-4340-bd05-b695b56e27ec?source=cve

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12495Academy Software Foundation OpenEXR EXR File Parsing Heap-ba…7.8
• CVE-2025-12496The Zephyr Project Manager plugin for WordPress is vulnerabl…4.9
• CVE-2025-12497The Premium Portfolio Features for Phlox theme plugin for Wo…8.1
• CVE-2025-12498The EventPrime – Events Calendar, Bookings and Tickets plugi…4.3
• CVE-2025-12499The Rich Shortcodes for Google Reviews plugin for WordPress …7.2
• CVE-2025-1250An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2025-12501Integer overflow in GameMaker IDE below 2024.14.0 version ca…7.5
• CVE-2025-12502The attention-bar WordPress plugin through 0.7.2.1 does not …6.8
• CVE-2025-12503EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a …7.1
• CVE-2025-12504Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2025-12505The weDocs plugin for WordPress is vulnerable to unauthorize…5.4
• CVE-2025-12506GitLab has remediated an issue in GitLab CE/EE affecting all…4.3