What is the CVSS score of CVE-2026-16285?

CVE-2026-16285 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WooCommerce Attachment are affected by CVE-2026-16285?

The Product Attachment for WooCommerce plugin (versions before 2.3.3) allows anyone to download confidential files from WordPress media libraries, including internal documents and product…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16285?

Yes, a public proof-of-concept exploit is available for CVE-2026-16285. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16285?

Within 24 hours, identify WordPress installations using Product Attachment for WooCommerce and audit media libraries for sensitive content; implement temporary access restrictions via WAF rules if patching cannot be completed immediately. Within 7 days, upgrade all affected instances to version 2.3.3 or later. Within 30 days, audit access logs to verify no unauthorized access occurred during the vulnerability period and confirm media file permissions are properly configured post-patch.

WooCommerce Attachment CVE-2026-16285

EUVD-2026-51945 HIGH

Missing Authorization (CWE-862)

2026-08-02 WPScan

GHSA-953r-r7wf-54g9

WordPress Authentication Bypass Product Attachment For Woocommerce Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Fully remote unauthenticated endpoint; enumeration is trivial; no integrity or availability impact; only confidentiality of media files is at risk.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:26 vuln.today

CVSS changed

Aug 03, 2026 - 18:22 NVD

7.5 (HIGH)

Patch available

Aug 02, 2026 - 07:00 EUVD

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment - including private or unlinked uploads - by enumerating its numeric ID.

AnalysisAI

Unauthorized media file disclosure in the Product Attachment for WooCommerce WordPress plugin (all versions before 2.3.3) allows any unauthenticated internet user to download arbitrary WordPress media library files by enumerating sequential numeric attachment IDs. The plugin's file-streaming endpoint performs no authorization check whatsoever, exposing private or deliberately unlinked uploads - such as internal documents, confidential product specifications, or draft media - to the public. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (5th percentile), indicating low observed exploitation rates at time of analysis despite easy weaponization.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization): the plugin registers a file-streaming endpoint to serve WooCommerce product attachments but never validates that the requester holds permission to access the requested media object. WordPress assigns sequential numeric post IDs to all media library entries, making brute-force enumeration trivial with no prior knowledge of file names or paths. The affected component is identified by CPE cpe:2.3:a:unknown:product_attachment_for_woocommerce:*:*:*:*:*:*:*:*, covering all releases prior to 2.3.3. The plugin is designed to extend WooCommerce by attaching downloadable files to product listings, which is precisely why it holds a streaming endpoint - the flaw is that this endpoint is exposed without a permission gate for any media library attachment, not only those explicitly linked to products.

RemediationAI

The primary and recommended fix is to update the Product Attachment for WooCommerce plugin to version 2.3.3 or later via the WordPress plugin dashboard or the WordPress.org plugin repository; this release adds the missing authorization check to the streaming endpoint. If an immediate upgrade is blocked by compatibility concerns, a temporary compensating control is to identify and block the plugin's file-serving URL pattern at the web server or WAF layer - for example, denying requests to the endpoint in nginx via a location block or in Apache via .htaccess - with the trade-off that this will also break legitimate attachment downloads for paying customers. Administrators should additionally audit the WordPress media library for sensitive documents (PDFs, spreadsheets, draft images) that should not be publicly accessible and either delete them or relocate them outside the webroot entirely. The WPScan advisory at https://wpscan.com/vulnerability/99a3a0a4-0e82-4388-88b2-72bd822904b5/ should be consulted for plugin-specific remediation notes.