Skip to content
Sign in
7.5 High

CVE-2026-16285 The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before…

Description

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.

Affected products and versions

Product Affected versions Fixed in
Product Attachment for WooCommerce 2.3 earliest → < 2.3.3 2.3.3
Track this CVE