Description
Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions.
Published: 2026-09-02
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows unauthenticated users to read or download files attached to WooCommerce products, potentially leaking confidential or proprietary information. It is an example of a data exposure weakness (CWE‑497) where the plugin fails to enforce proper access restrictions on attachments.

Affected Systems

The affected product is the WooCommerce Product Attachment plugin, 2.3.3 or earlier, distributed by Dotstore. It is used in WordPress installations that host WooCommerce stores. No specific operating system or additional environment dependencies are cited.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. No EPSS score is provided, but the vulnerability is classified as unauthenticated, which means an attacker can exploit it without needing to authenticate to the site. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed in the wild, though the risk of data leakage remains significant. An attacker could craft a URL or use automated queries to enumerate and download attachments that should be protected.

Generated by OpenCVE AI on September 2, 2026 at 12:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WooCommerce Product Attachment to the latest version (any release newer than 2.3.3).
  • After upgrading, verify that all recent attachments are housed on a directory that requires proper authentication or access control rules.
  • If an upgrade is not immediately possible, restrict direct URL access to the attachment folder by implementing IP whitelisting or authentication checks via the web server or a security plugin.

Generated by OpenCVE AI on September 2, 2026 at 12:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions.
Title WordPress WooCommerce Product Attachment plugin <= 2.3.3 - Sensitive Data Exposure vulnerability
Weaknesses CWE-497
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-02T12:33:44.710Z

Reserved: 2026-08-27T12:24:18.942Z

Link: CVE-2026-81774

cve-icon Vulnrichment

Updated: 2026-09-02T12:33:31.026Z

cve-icon NVD

Status : Deferred

Published: 2026-09-02T12:17:13.413

Modified: 2026-09-02T13:54:48.797

Link: CVE-2026-81774

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T12:30:13Z

Weaknesses
  • CWE-497

    Exposure of Sensitive System Information to an Unauthorized Control Sphere