{
 "id": "WPSEC-2026-2843",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2843/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2843/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2843/index.md",
 "title": "WooCommerce <= 11.2.2 - Unauthenticated Sensitive Information Exposure via Downloadable Product File Attachments",
 "description": "The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via downloadable product file attachments in all versions up to, and including, 11.2.2. Files uploaded for downloadable products are stored in the woocommerce_uploads directory as media attachments that WordPress treats as public, and the plugin did not hide them from the REST API media endpoint, attachment pages, feeds, GUIDs or oEmbed responses. This makes it possible for unauthenticated attackers to find the direct URLs of downloadable product files, including the random suffix added to their file names. Where the server does not enforce the directory's .htaccess rules (for example on Nginx) or the 'redirect' download method is used, they can then download paid files without buying them.",
 "plugin": {
  "slug": "woocommerce",
  "name": "WooCommerce",
  "full_name": "WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.3.0",
 "remediation": "Update to 11.3.0 or later.",
 "fix_released": "2026-11-11T12:43:00+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:04:16.936879+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2843/",
  "https://plugins.svn.wordpress.org/woocommerce/tags/11.3.0/",
  "https://wordpress.org/plugins/woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}