{"id":4308,"date":"2026-09-04T18:46:24","date_gmt":"2026-09-04T10:46:24","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-16285"},"modified":"2026-09-04T18:46:24","modified_gmt":"2026-09-04T10:46:24","slug":"cve-2026-16285","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-16285","title":{"rendered":"CVE-2026-16285 [HIGH] &#8211; The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any"},"content":{"rendered":"<p>The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment \u2014 including private or unlinked uploads \u2014 by enumerating its numeric ID.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attac<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4308","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}