high7.5
CVE-2026-16285
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing un…
Impact
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.
Affected products
| Product | Affected versions |
|---|---|
| Product Attachment For WooCommerce WordPress Plugin | before 2.3.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.