Unauthorized File Access in WooCommerce Product Attachment Plugin
CVE-2026-16285
What is CVE-2026-16285?
The Product Attachment for WooCommerce plugin for WordPress prior to version 2.3.3 contains a significant security oversight, failing to enforce authorization checks before allowing access to media library files. This vulnerability enables unauthenticated users to exploit the system and download attachments by merely guessing their numeric IDs. The implications of this flaw include potential exposure of sensitive data that may otherwise be restricted, affecting the privacy of file uploads, particularly those that are private or unlinked.
Affected Version(s)
Product Attachment for WooCommerce 0 < 2.3.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.