Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data. The plugin incorrectly exposes embedded sensitive data via the attachment URLs, allowing an attacker to retrieve files that should be protected. Because the flaw is a data exposure flaw (CWE‑497) and does not require authentication, it permits an adversary to read or download these files without credentials, leading to unauthorized disclosure of potentially confidential information.

The affected product is the WooCommerce Product Attachment plugin distributed by Dotstore, versions 2.3.4 and earlier. These plugins run on WordPress sites that host WooCommerce stores; no particular operating system constraints are mentioned. The vulnerability exists in all prior releases up to 2.3.4.

The CVSS score of 7.5 indicates high severity. The EPSS score of <1% implies a very low probability of exploitation at present. The vulnerability remains unlisted in the CISA KEV catalog, which suggests no known exploits in the wild. Based on the description, it is inferred that the likely attack vector is remote unauthenticated HTTP requests to the attachment URL; an attacker can simply request the file via a crafted HTTP request and obtain the content, exposing any attached files that should remain private.