THREAT OPS › Threat News › [NVD] CVE-2026-16285 — The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.
[NVD] CVE-2026-16285 — The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.
CVE-2026-16285 CVSS: None Published: 2026-08-02T06:16:40.113
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.
Indicators of compromise
- CVE-2026-16285cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16285