CVE-2026-81774: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Dotstore WooCommerce Product Attachment

This vulnerability in WooCommerce Product Attachment (<= 2.3.3) allows unauthenticated users to access sensitive system information that should be restricted. The issue is categorized as CWE-497, which involves exposure of sensitive data to unauthorized entities. The CVSS 3.1 base score is 7.5, reflecting a high impact on confidentiality with no required privileges or user interaction. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

An attacker can gain access to sensitive system information without authentication, potentially leading to further attacks or information leakage. The confidentiality impact is high, but integrity and availability are not affected. This exposure could aid attackers in reconnaissance or facilitate subsequent exploitation steps.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for unusual activity related to WooCommerce Product Attachment. Avoid exposing the plugin to untrusted users if possible.