CyberRota Analysis
AI-GeneratedThe Product Attachment for WooCommerce plugin in WordPress versions prior to 2.3.3 is vulnerable due to a lack of authorization checks, enabling unauthenticated users to access and download any media library files, including private attachments, by exploiting numeric ID enumeration. This poses a significant risk of data exposure for e-commerce sites using the plugin. WordPress site administrators utilizing this plugin should prioritize updating to the latest version to mitigate this vulnerability.
Original NVD Description
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.