The Active Woot Products Tables for WooCommerce.
CVE-2026-120560
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the gettabledata() AJAX handler — registered for unauthenticated access via wpajaxnoprivwootgettabledata — performing no nonce verification and no capability check before passing the attacker-supplied wpcolumnsactions parameter directly to applyfilters() alongside an attacker-controlled integer derived from the tableid parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads directory by supplying a known or guessed numeric attachment ID, enabling complete erasure of a site's media library. Exploitation is achievable because WordPress core registers wpdeleteattachment() as a callback on hooks such as upgraderscheduledcleanup and importerscheduledcleanup, which sanitizekey() does not strip; notably, only attachment posts reachable by numeric ID are affected, and files outside wp-content/uploads — such as wp-config.php or plugin PHP files — cannot be targeted through this path.
Assessment
- CVSS
- 6.5 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 7 November 2026
- Last updated
- 7 November 2026
- Assigner
- Wordfence
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
At the source
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a4962c61-9059-4fb9-9ddf-5e6aa1d2675a?source=cve
- https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1206
- https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1094
- https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1090
- https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L91
- https://plugins.svn.wordpress.org/profit-products-tables-for-woocommerce/trunk/index.php
- https://plugins.trac.wordpress.org/changeset/3784667/profit-products-tables-for-woocommerce/trunk/index.php
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-120560