PT-2026-20584 · WordPress+1 · Checkout Fields Manager+1

Burak Kılınç · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-12500

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Checkout Field Manager (Checkout Manager) for WooCommerce versions prior to 7.8.2

Description The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is susceptible to unauthenticated limited file upload. This is caused by insufficient authorization checks when handling file upload actions through the ajax checkout attachment upload function. An unauthenticated attacker can upload files to the server, but the file types are restricted to WordPress's default allowed MIME types, such as images and documents.

Recommendations Update to Checkout Field Manager (Checkout Manager) for WooCommerce version 7.8.2 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12500

Affected Products

Checkout Fields Manager

Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12500 · Security Note
• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L19 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e807480b-00c9-4340-bd05-b695b56e27ec?source=cve · Note
• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L143 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3404371%40woocommerce-checkout-manager&new=3404371%40woocommerce-checkout-manager&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2025892086701027629 · Twitter Post
• https://t.me/CVEtracker/45065 · Telegram Post
• https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L30 · Note