CVE-2026-16285
Received Received - Intake

Unauthenticated File Download in WooCommerce Product Attachment

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-16285
EUVD
EUVD-2026-51945

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce product_attachment to 2.3.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Product Attachment for WooCommerce WordPress plugin before version 2.3.3. It allows unauthenticated users to download any file from the media library by guessing its numeric ID, including private or unlinked files, due to missing authorization checks.

Detection Guidance

To detect this vulnerability, check if your WooCommerce Product Attachment plugin is outdated. Run: wp plugin list | grep product_attachment. If installed, verify version with: wp plugin get product_attachment. Also inspect server access logs for unusual download patterns or requests to media library files with numeric IDs.

Impact Analysis

An attacker could exploit this to access sensitive files, such as private documents or unlisted media, potentially leading to data breaches or unauthorized information disclosure. This could affect both site owners and users if confidential data is exposed.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or protected health information. Organizations may face legal penalties, fines, or reputational damage due to data exposure.

Mitigation Strategies

Immediately update the Product Attachment for WooCommerce plugin to version 2.3.3 or later. If an update is unavailable, consider disabling the plugin temporarily. Review file permissions on your media library to restrict unauthorized access. Monitor for any suspicious download activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart