What is the CVSS score of CVE-2026-3835?

CVE-2026-3835 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Prevent Direct Access CVE-2026-3835

EUVD-2026-57720 MEDIUM

Improper Authorization (CWE-285)

2026-08-13 Wordfence

GHSA-xxpw-3xg9-qwph

WordPress Authentication Bypass Wordpress Plugin Prevent Direct Access Protect Wordpress Files Buildwps

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint, trivially simple bypass (single wildcard character), no auth required, and confidentiality impact is bounded to plugin-managed files only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 06:00 vuln.today

CVE Published

Aug 13, 2026 - 05:29 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Prevent Direct Access - Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get_advance_file_by_url() method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token lookup without escaping wildcard characters via $wpdb->esc_like(). This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as %) as the token value, matching any record in the plugin's file table and downloading any protected file.

AnalysisAI

Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The get_advance_file_by_url() method in includes/repository.php performs token validation using a SQL LIKE clause without sanitizing input via $wpdb->esc_like(), meaning a request supplying % as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.

Technical ContextAI

The plugin's core function is to intercept direct file download requests and gate them behind a private token stored in a custom database table. The vulnerable code path, get_advance_file_by_url() in includes/repository.php (line 221), constructs a SQL query using WordPress's $wpdb abstraction with a LIKE operator to match the caller-supplied token against stored values. Because $wpdb->esc_like() is not called before interpolating the token into the query, MySQL wildcard characters - specifically % (matches any sequence of characters) and _ (matches any single character) - are passed through unescaped. A token value of % therefore satisfies the LIKE condition for every row in the table, returning the first matching record and granting access to its associated file. The CWE-285 (Improper Authorization) root cause is accurate: the authorization gate itself is bypassed rather than a secondary injection exploited. CPE cpe:2.3:a:buildwps:prevent_direct_access_-_protect_wordpress_files:*:*:*:*:*:*:*:* confirms the scope is the plugin by BuildWPS across all versions through 2.8.8.8.

RemediationAI

Update the Prevent Direct Access plugin to version 2.8.8.9 or later immediately. The fix is confirmed in the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&new=3637502%40prevent-direct-access%2Ftags%2F2.8.8.9&old=3524320%40prevent-direct-access%2Ftags%2F2.8.8.8, which introduces proper $wpdb->esc_like() sanitization in repository.php. As a temporary compensating control before patching, administrators can add .htaccess or Nginx rules that block requests containing % (URL-encoded as %25) to the plugin's download endpoint path - note this may interfere with legitimate token URLs that contain percent-encoded characters and should be tested carefully. Alternatively, disabling the plugin eliminates the attack surface but also removes file protection, making previously protected files accessible via their original upload URLs. Neither workaround substitutes for the patch.