# Product Attachment for WooCommerce <= 2.3.4 - Unauthenticated Insecure Direct Object Reference to Order Attachment Download

- **ID:** WPSEC-2026-1033
- **Plugin:** Product Attachment for WooCommerce (`woo-product-attachment`), https://wordpress.org/plugins/woo-product-attachment/
- **Affected versions:** all versions before 2.3.5
- **Fixed in:** 2.3.5 (Update to 2.3.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-product-attachment
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1033/

## Description

The Product Attachment for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the attachment download handler in all versions up to, and including, 2.3.4, due to the authorization check not tying the user-supplied 'download_file' key to the requested 'attachment_id'. When an order ID is supplied, the plugin only checks that the attachment is stored somewhere on that order, and does not check that the requester owns the order. Its bulk and line-item expiry checks also match the key without checking the file ID. This makes it possible for unauthenticated attackers who have any valid attachment key (such as one shown on a public product page) to download private files stored on other customers' orders, such as checkout uploads and order attachments, by supplying the order ID and attachment ID.

## References

- https://wpsec.com/vuln/WPSEC-2026-1033/
- https://plugins.svn.wordpress.org/woo-product-attachment/tags/2.3.5/
- https://wordpress.org/plugins/woo-product-attachment/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1033/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.