PT-2026-20584 · WordPress+1 · Checkout Fields Manager+1

Burak Kılınç · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-12500

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Checkout Field Manager (Checkout Manager) for WooCommerce versions prior to 7.8.2

Description The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is susceptible to unauthenticated limited file upload. This is caused by insufficient authorization checks when handling file upload actions through the ajax checkout attachment upload function. An unauthenticated attacker can upload files to the server, but the file types are restricted to WordPress's default allowed MIME types, such as images and documents.

Recommendations Update to Checkout Field Manager (Checkout Manager) for WooCommerce version 7.8.2 or later.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2025-12500

Produtos afetados

Checkout Fields Manager

Woocommerce

Referências · 8

• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L19 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/e807480b-00c9-4340-bd05-b695b56e27ec?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L143 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12500 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3404371%40woocommerce-checkout-manager&new=3404371%40woocommerce-checkout-manager&sfp_email=&sfph_mail= · Nota
• https://twitter.com/CVEnew/status/2025892086701027629 · Publicação no Twitter
• https://t.me/CVEtracker/45065 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L30 · Nota