File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

Description

The plugin stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the plugin's authenticated download mechanism.