The Active Woot Products Tables for WooCommerce WordPress plugin (up to version 2.1.5) contains a vulnerability allowing unauthenticated attackers to delete media library attachments and their files. This occurs due to an AJAX handler lacking nonce verification and capability checks, enabling deletion of files in the uploads directory by supplying a numeric attachment ID. Files outside the uploads directory cannot be deleted via this flaw.