CVE-2026-16285CWE-862broken-access-control
CVE-2026-16285
High · published August 2, 2026
What it is
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00406 · 33.8th percentile
- Weakness
- CWE-862 · Missing Authorization
- Published
- 2026-08-02T10:16Z
References (1)
EPSS history
Timeline