CVE-2026-16285 — WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

CVE-2026-16285

WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download PUBLISHED

Description (CNA)

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.

Affected (CNA)

Vendor / product	Versions
Unknown / Product Attachment for WooCommerce	affected 0 before 2.3.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/99a3a0a4-0e82-4388-88b2-72bd822904b5/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.