The Product Attachment for WooCommerce plugin before version 2.3.3 does not perform an authorization check when streaming media library files. This flaw allows any visitor, even those not logged in, to download any attachment by guessing or enumerating the numeric ID of the file. The result is a direct breach of confidentiality, as private or unlinked uploads can be retrieved without permission.

Any WordPress installation that uses the Plugin \"Product Attachment for WooCommerce\" with a version older than 2.3.3 is vulnerable. The vendor is not specified, so the risk applies broadly to all sites deploying this plugin without the fixed release.

The EPSS score of <1% and the absence of a KEV listing suggest limited exploitation evidence, but the flaw still provides a trivial exploitation path. An attacker only needs to guess or iterate numeric identifiers for media files, and due to the lack of an authorization check, any file—private or unlinked—becomes downloadable. With a CVSS score of 7.5, the vulnerability is classified as High severity and could expose confidential attachments. The weakness corresponds to CWE‑862 (Inadequate Authorization), emphasizing that authorization checks are missing.