CVE-2026-81774: WooCommerce Product Attachment Data Exposure

CVE-2026-81774 Overview

CVE-2026-81774 is an unauthenticated sensitive data exposure vulnerability affecting the WooCommerce Product Attachment plugin for WordPress in versions 2.3.3 and earlier. The flaw allows remote attackers to retrieve protected file attachments without authentication, exposing information intended for authorized customers only. The issue is categorized under CWE-497, Exposure of Sensitive System Information to an Unauthorized Control Sphere. Exploitation requires no user interaction and no privileges, making the plugin's attachment endpoints accessible to anonymous requests over the network.

Critical Impact

Unauthenticated remote attackers can access product-linked file attachments, potentially exposing licenses, invoices, contracts, or other confidential documents distributed through WooCommerce stores.

Affected Products

• WooCommerce Product Attachment plugin (woo-product-attachment) versions <= 2.3.3
• WordPress sites running WooCommerce with the vulnerable plugin installed
• E-commerce deployments delivering gated downloads through the plugin

Discovery Timeline

• 2026-09-02 - CVE-2026-81774 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81774

Vulnerability Analysis

The WooCommerce Product Attachment plugin lets store owners attach downloadable files to WooCommerce products for delivery to buyers. In versions up to and including 2.3.3, the plugin exposes attachment retrieval logic without enforcing authentication or authorization checks. Anonymous HTTP requests can invoke the attachment handlers and receive files that should be restricted to purchasers or logged-in users. The confidentiality impact is high, while integrity and availability remain unaffected because the flaw only enables reading of protected resources.

Root Cause

The root cause is missing authentication and access control on the plugin's file-serving code path, aligned with CWE-497. The plugin does not validate the requester's identity, order ownership, or capability before returning attachment content. As a result, references to protected files are treated as public resources rather than gated downloads.

Attack Vector

Attackers exploit the flaw remotely over HTTP or HTTPS. The attack requires no credentials, no user interaction, and low complexity. An attacker enumerates or guesses attachment identifiers and issues direct requests to the plugin's download endpoints. Successful requests return the file contents, disclosing data intended only for paying customers or administrators. Details are documented in the Patchstack advisory.

No public exploit code or verified proof-of-concept is available at time of publication. The vulnerability mechanism is described in prose only; see the Patchstack advisory linked above for further technical context.

Detection Methods for CVE-2026-81774

Indicators of Compromise

• Unauthenticated HTTP GET requests to plugin download endpoints associated with woo-product-attachment
• Repeated sequential access attempts to attachment identifiers from a single source IP
• Web server access logs showing successful 200 responses to attachment URLs from clients without active WooCommerce sessions
• Outbound transfer volumes from /wp-content/uploads/ paths that do not correlate with logged-in customer activity

Detection Strategies

• Inspect WordPress and web server logs for anonymous requests to plugin routes that return file payloads
• Correlate download events with authenticated session identifiers and order records to surface mismatches
• Deploy a web application firewall rule to flag high-frequency access to woo-product-attachment endpoints from a single client

Monitoring Recommendations

• Enable verbose HTTP access logging on the WordPress front end, including query strings and referrers
• Alert on spikes in bandwidth served from WooCommerce attachment directories
• Track user-agent diversity against attachment endpoints to identify scripted enumeration

How to Mitigate CVE-2026-81774

Immediate Actions Required

• Update the WooCommerce Product Attachment plugin to a version later than 2.3.3 as soon as the vendor publishes a fixed release
• Audit the wp-content/uploads/ directory and remove sensitive files that should not be publicly retrievable
• Rotate any credentials, license keys, or tokens that may have been distributed through the plugin
• Review WooCommerce order history and access logs for anomalous attachment retrieval

Patch Information

Refer to the Patchstack advisory for the current patch status. If no fixed version is available, deactivate and remove the plugin until the vendor publishes a remediated release.

Workarounds

• Deactivate the woo-product-attachment plugin until a patched version is available
• Restrict access to attachment endpoints with web server rules requiring authenticated WordPress sessions
• Move sensitive attachments behind a signed-URL or capability-gated download mechanism outside the plugin
• Apply virtual patching via a web application firewall to block unauthenticated requests to plugin routes

# Example Nginx rule to block unauthenticated access to plugin attachment routes
location ~* /wp-content/plugins/woo-product-attachment/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}