CVE-2026-16285

UNKNOWN 0.0

WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.

Vendor	unknown
Product	product attachment for woocommerce
Published	Aug 2, 2026

Stay Ahead of the Next One

Get instant alerts for unknown product attachment for woocommerce

Be the first to know when new unknown vulnerabilities affecting unknown product attachment for woocommerce are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Product Attachment for WooCommerce

0 < 2.3.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/99a3a0a4-0e82-4388-88b2-72bd822904b5/

Credits

kevin(@OPCIA) WPScan