CVE-2026-81774: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Dotstore WooCommerce Product Attachment

This vulnerability in the WooCommerce Product Attachment plugin by Dotstore allows an attacker to retrieve embedded sensitive system information without authentication or user interaction. The affected versions include all releases up to and including 2.3.4. The vulnerability is classified under CWE-497 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

Successful exploitation results in unauthorized disclosure of sensitive system information, which could aid attackers in further attacks or reconnaissance. The vulnerability does not impact integrity or availability but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the affected plugin and monitor for unusual activity related to product attachments.