# WooCommerce <= 11.2.2 - Unauthenticated Sensitive Information Exposure via Downloadable Product File Attachments

- **ID:** WPSEC-2026-2843
- **Plugin:** WooCommerce (`woocommerce`), https://wordpress.org/plugins/woocommerce/
- **Affected versions:** all versions before 11.3.0
- **Fixed in:** 11.3.0 (Update to 11.3.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2843/

## Description

The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via downloadable product file attachments in all versions up to, and including, 11.2.2. Files uploaded for downloadable products are stored in the woocommerce_uploads directory as media attachments that WordPress treats as public, and the plugin did not hide them from the REST API media endpoint, attachment pages, feeds, GUIDs or oEmbed responses. This makes it possible for unauthenticated attackers to find the direct URLs of downloadable product files, including the random suffix added to their file names. Where the server does not enforce the directory's .htaccess rules (for example on Nginx) or the 'redirect' download method is used, they can then download paid files without buying them.

## References

- https://wpsec.com/vuln/WPSEC-2026-2843/
- https://plugins.svn.wordpress.org/woocommerce/tags/11.3.0/
- https://wordpress.org/plugins/woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2843/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.