CVE-2026-16285

The CVE-2026-16285 entry concerns the Product Attachment for WooCommerce WordPress plugin prior to 2.3.3 . The issue is an missing authorization check when streaming files from the media library, allowing unauthenticated users to download any attachment (including private or unlinked uploads) by ...

WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Product Attachment Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-40212 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8ec007daa0bf Credits Mika...