CVE-2026-16285: WooCommerce Plugin Auth Bypass Flaw

CVE-2026-16285 Overview

CVE-2026-16285 is a missing authorization vulnerability in the Product Attachment for WooCommerce WordPress plugin before version 2.3.3. The plugin streams media library files without performing any authorization check. Unauthenticated attackers can download any attachment stored in the WordPress media library, including private or unlinked uploads, by enumerating numeric file IDs. The flaw is categorized under [CWE-862] (Missing Authorization) and affects the confidentiality of hosted content.

Critical Impact
Unauthenticated remote attackers can enumerate and download arbitrary media library files, exposing private documents, invoices, and unlinked uploads without any user interaction.

Affected Products

Product Attachment for WooCommerce WordPress plugin versions prior to 2.3.3

Discovery Timeline

2026-08-02 - CVE-2026-16285 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16285

Vulnerability Analysis

The Product Attachment for WooCommerce plugin exposes a file-streaming endpoint that accepts a numeric attachment identifier and returns the corresponding media file. The endpoint does not verify whether the requester has permission to access the requested attachment. Any HTTP client can iterate through sequential IDs and retrieve every file registered in the WordPress media library.

This behavior breaks the access model expected of private and unlinked uploads. Merchants commonly attach invoices, license keys, digital goods, and internal documents to WooCommerce products under the assumption that only paying customers can retrieve them. The missing check invalidates that assumption for every media item on the site.

The issue is documented in the WPScan Vulnerability Report.

Root Cause

The streaming handler retrieves the file path from the attachment ID and returns file contents without calling a capability check such as current_user_can() or verifying purchase-based entitlement. The absence of an authorization gate before the file read constitutes the [CWE-862] weakness.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends unauthenticated HTTP requests to the vulnerable endpoint, incrementing the numeric attachment ID parameter. Each request returns the raw file content when the ID resolves to a valid media entry. No credentials, tokens, or user interaction are required.

No verified public proof-of-concept code is available. See the referenced WPScan advisory for technical details.

Detection Methods for CVE-2026-16285

Indicators of Compromise

Sequential HTTP GET requests from a single source that iterate numeric attachment ID parameters against the plugin's download endpoint.
High volume of successful 200 OK responses returning application/octet-stream or document MIME types to unauthenticated sessions.
Access log entries for media downloads without a preceding authenticated session cookie or WooCommerce order context.

Detection Strategies

Inspect web server access logs for enumeration patterns targeting the Product Attachment for WooCommerce download handler.
Correlate download events with WooCommerce order records to identify file retrievals that lack a matching purchase.
Alert on unauthenticated IP addresses generating repeated attachment download requests over short intervals.

Monitoring Recommendations

Enable verbose access logging on the WordPress host and forward logs to a centralized analytics platform for retention and search.
Baseline normal media download volume per source IP and trigger alerts on sudden spikes.
Monitor outbound bandwidth from the WooCommerce site for anomalous transfer volumes indicative of mass scraping.

How to Mitigate CVE-2026-16285

Immediate Actions Required

Update the Product Attachment for WooCommerce plugin to version 2.3.3 or later on all affected WordPress sites.
Audit the WordPress media library for sensitive files and remove any that should not be exposed through the plugin.
Review access logs for evidence of prior enumeration against the plugin's download endpoint.

Patch Information

The vendor addressed the missing authorization check in Product Attachment for WooCommerce version 2.3.3. Administrators should apply the update through the WordPress plugin manager or by deploying the updated package manually. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate the Product Attachment for WooCommerce plugin until the patched version is installed.
Restrict access to the plugin's download endpoint at the web server or web application firewall layer, limiting requests to authenticated sessions.
Move sensitive attachments out of the WordPress media library and serve them through an access-controlled storage location.

bash

# Configuration example: block unauthenticated access to the plugin download handler in nginx
location ~* /wp-content/plugins/product-attachment-for-woocommerce/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}