Executive brief
The Product Attachment for WooCommerce plugin fails to verify user permissions before serving media files from the WordPress library. An attacker can download any uploaded file—including private or unpublished attachments—simply by guessing numeric file IDs, without needing to log in. This exposes sensitive documents, images, and other business files that site operators intended to keep private.
Technical details
The plugin contains a broken access control vulnerability (CWE-862) in its media streaming handler on the front-end init hook. The handler processes requests with an attachment_id parameter and returns file streams without verifying user authentication or authorization. An unauthenticated attacker can enumerate sequential attachment IDs and retrieve any file by sending a simple HTTP request, receiving the raw file with Content-Disposition headers. The vulnerability requires no authentication, credentials, or user interaction. Fixed in version 2.3.3, which now returns HTTP 403 for unauthorized access attempts.
Affected products
- WooCommerce Product Attachment for WooCommerce before 2.3.3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in version 2.3.3