CVE-2026-3835
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token vali…
Impact
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://plugins.trac.wordpress.org/browser/prevent-direct-access/tags/2.8.8.4/includes/repository.php#L221
- https://plugins.trac.wordpress.org/browser/prevent-direct-access/trunk/download.php#L377
- https://plugins.trac.wordpress.org/browser/prevent-direct-access/trunk/includes/repository.php#L221
- https://plugins.trac.wordpress.org/changeset/3637499/prevent-direct-access/trunk/includes/repository.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fprevent-direct-access/tags/2.8.8.8&new_path=%2Fprevent-direct-access/tags/2.8.8.9
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3637502%40prevent-direct-access%2Ftags%2F2.8.8.9&old=3524320%40prevent-direct-access%2Ftags%2F2.8.8.8
- https://wordpress.org/plugins/prevent-direct-access/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c39d16f1-ce80-402c-8a36-f9070dc5f9c9?source=cve