CVE-2026-3835

Summary

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get_advance_file_by_url() method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token lookup without escaping wildcard characters via $wpdb->esc_like(). This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as %) as the token value, matching any record in the plugin's file table and downloading any protected file.

Affected Software

VendorProductVersion RangeStatus
buildwpsPrevent Direct Access – Protect WordPress Files0 <= 2.8.8.8affected

Weaknesses

  • CWE-285: CWE-285 Improper Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References