VulnSocial

CVE-2026-16285Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 2 classified signals
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-08-02: 4Technical Details · 2026-08-02: 308-02
Signal classification2 categories
Disclosure
250.0%
General
250.0%
Referenced assets4 URLs
Full discourse4 posts
  • MalwareObserver@MalwareObserver
    General

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-16285](https://wpscan.com/vulnerability/99a3a0a4-0e82-4388-88b2-72bd822904b5/) The Prod... https://wpscan.com/vulnerability/99a3a0a4-0e82-4388-88b2-72bd822904b5/ #CVE #ZeroDay #PatchManagement

    Post summary

    The tweet alerts to CVE‑2026‑16285 as a zero‑day vulnerability, linking to a scan page, but offers no technical, exploit, or patch details.

    0000041
    18 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-16285 Unauthenticated Arbitrary File Download in Product Attachment for WooCommerce Before 2.3.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16285

    Post summary

    The passage identifies CVE-2026-16285 as an unauthenticated arbitrary file download flaw in WooCommerce prior to version 2.3.3, offering no additional technical or mitigation details.

    00000120
    4.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-16285 The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthent… https://www.cve.org/CVERecord?id=CVE-2026-16285 ----- Traducción: CVE-2026-16285 El … http://infoflow.cloud`

    Post summary

    A new CVE (CVE-2026-16285) is disclosed for the WooCommerce WordPress plugin version prior to 2.3.3, noting an unauthenticated file access flaw; no exploitation, patch, or PoC details are provided.

    0000035
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-16285 The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthent… https://www.cve.org/CVERecord?id=CVE-2026-16285

    Post summary

    The CVE describes a missing authorization check in the WooCommerce Product Attachment plugin that permits unauthenticated access to media files; no PoC, exploit, or patch details are included.

    000001.1K
    57.9K followersView on X

Explore more

Back to dashboard