The Checkout Field Manager (Checkout Manager) for WooCommerce plugin suffers from an unauthenticated limited file upload vulnerability (CWE-434) because the ajax_checkout_attachment_upload function does not properly verify user authorization. This allows attackers without any privileges to upload files restricted to WordPress's default allowed MIME types. The vulnerability is present in all versions up to 7.8.1 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No known exploits are reported in the wild, and no official patch or remediation has been confirmed.

An unauthenticated attacker can upload files to the server, but only files with MIME types allowed by WordPress by default (such as images and documents). This could lead to limited impact such as uploading malicious files that might be used in further attacks if combined with other vulnerabilities or misconfigurations. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for unauthorized uploads if possible. Avoid relying solely on MIME type restrictions for security.