CVE-2026-16285

The CVE-2026-16285 affects the WooCommerce Product Attachment WordPress plugin (prior to version 2.3.3). The root cause is a missing authorization check when streaming media library files, enabling unauthenticated users to download any attachment by enumerating its numeric ID. Impact is stated as...

WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Product Attachment Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-40212 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8ec007daa0bf Credits Mika...