Description

Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T12:17:13.413Z",
  "pubdate": "2026-09-02T12:17:13.413Z",
  "executiveSummary": "The WooCommerce Product Attachment plugin, specifically versions 2.3.3 and earlier, contains a critical security vulnerability classified as Unauthenticated Sensitive Data Exposure.\nThis flaw allows remote, unauthenticated attackers to bypass access control mechanisms and gain unauthorized read access to protected files and sensitive product attachments associated with the WordPress site.\nThe vulnerability resides in the plugin's insecure handling of attachment requests, which fails to validate the user's session or authorization level before serving content.\nBy manipulating specific parameters in the HTTP request, an external actor can retrieve files that were intended to be private, restricted, or hidden from public view.\nThe impact is significant, as it leads to a total compromise of confidentiality for all sensitive data managed by the plugin, potentially exposing proprietary documentation, private client information, or restricted commercial materials.\nExploitation does not require elevated privileges or interaction from an administrator, making it a high-risk vector for automated scanning and mass exploitation efforts.\nSecurity teams must address this by restricting access to the affected endpoints or updating the plugin software immediately if an official vendor patch is available.",
  "technicalDetails": "The vulnerability originates from a deficiency in access control enforcement within the WooCommerce Product Attachment plugin codebase. The plugin fails to adequately implement verification checks for the current user's session or capability levels (e.g., 'manage_woocommerce' or similar) when a request is made for an attachment resource.\nThe core of the issue lies in the lack of server-side sanitization and authorization logic when handling file retrieval requests. Typically, these requests are processed through a specific route or function that incorrectly assumes that the presence of an attachment ID is sufficient to grant access. Because the plugin does not verify if the requester has the appropriate permissions to view the target file, it becomes possible to perform an Insecure Direct Object Reference (IDOR) style attack.\nAn attacker can exploit this by identifying the URL structure used by the plugin to serve attachments. By iterating through or guessing the attachment IDs associated with the system, an attacker can construct unauthorized HTTP GET requests. Since the application logic lacks an authentication middleware or a permission check function (such as current_user_can()) before the file stream is initialized, the application proceeds to serve the file directly to the client.\nThe attack flow follows these steps: 1) The attacker identifies the plugin's file-serving endpoint on a target WordPress instance. 2) The attacker enumerates potential attachment IDs or monitors network traffic to discover valid file identifiers. 3) The attacker crafts a request, omitting authentication headers or cookies, to the vulnerable endpoint with a target attachment ID. 4) The application, failing to enforce restrictive access policies, processes the request and streams the requested file content back to the attacker's browser or tool.\nThis behavior exposes sensitive files stored within the 'wp-content/uploads' directory or other plugin-managed storage paths. The post-exploitation impact includes the systematic scraping of restricted business assets, potentially leading to the disclosure of sensitive commercial data, private customer contracts, or proprietary intellectual property. Because the vulnerability is exposed directly via the web server, the exploit is executable from any network location with reachability to the web application's frontend."
}