CVE-2026-16285

WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.

Affected

Product Attachment for WooCommerce

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 33rd percentile

Published

2026-08-02

Updated

2026-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/99a3a0a4-0e82-4388-88b2-72bd822904b5/

References

• CVE Record
• NVD entry