CVE-2026-16285 — WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated user…
Published: 2026-08-02 · CVSS: 7.5 · CVSS 3.1
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7