Question 1

What is CVE-2026-16285 — CVE-2026-16285?

Accepted Answer

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.

Question 2

What is the authoritative source for CVE-2026-16285?

Accepted Answer

CVE-2026-16285 (CVE-2026-16285) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVE-2026-16285CVE-2026-16285

Description

Scoring