CVE-2026-3835 PUBLISHED

Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access

Assigner: Wordfence
Reserved: 09.03.2026 Published: 13.08.2026 Updated: 13.08.2026

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get_advance_file_by_url() method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token lookup without escaping wildcard characters via $wpdb->esc_like(). This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as %) as the token value, matching any record in the plugin's file table and downloading any protected file.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor buildwps
Product Prevent Direct Access – Protect WordPress Files
Versions Default: unaffected
  • affected from 0 to 2.8.8.8 (incl.)

Credits

  • Lucas Montes (NiRoX) finder

References

Problem Types

  • CWE-285 Improper Authorization CWE