WooCommerce <= 11.2.2 - Unauthenticated Sensitive Information Exposure via Downloadable Product File Attachments
- ID
- WPSEC-2026-2843
- Plugin
- WooCommerce (woocommerce)
- Affected
- all versions before 11.3.0
- Remediation
- Update to 11.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-12
- Attack surface
- WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via downloadable product file attachments in all versions up to, and including, 11.2.2. Files uploaded for downloadable products are stored in the woocommerce_uploads directory as media attachments that WordPress treats as public, and the plugin did not hide them from the REST API media endpoint, attachment pages, feeds, GUIDs or oEmbed responses. This makes it possible for unauthenticated attackers to find the direct URLs of downloadable product files, including the random suffix added to their file names. Where the server does not enforce the directory's .htaccess rules (for example on Nginx) or the 'redirect' download method is used, they can then download paid files without buying them.
References
- https://wpsec.com/vuln/WPSEC-2026-2843/
- https://plugins.svn.wordpress.org/woocommerce/tags/11.3.0/
- https://wordpress.org/plugins/woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS