User Private Files CVE-2026-97331

Exploitation requires an authenticated account on the target site (PR:L) - specifically any registered user such as a Subscriber - and the site must run User Private Files prior to version 2.1.9. The concrete trigger is invoking the plugin's user/document operation with a user identifier that does not belong to a document the attacker owns; the plugin omits the ownership-to-user validation and returns the supplied user's email. Limiting factors: an attacker needs valid credentials, so sites that disable open user registration substantially reduce exposure; no user interaction is required (UI:N) and no non-default configuration is needed beyond having the plugin installed and users present to enumerate. Impact is confined to disclosure of email addresses (C:L) with no data modification or service disruption.

This is a genuine but low-to-moderate priority issue, not a critical one. The CVSS 3.1 base score of 4.3 (Medium) aligns with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N: network-reachable, low complexity, but requiring at least low-privilege authentication (PR:L) and yielding only a limited confidentiality impact (C:L) with no integrity or availability effect. The real-world concern is that the authentication barrier is trivially low - any Subscriber-level account, which many WordPress sites allow via open registration, suffices. A public exploit exists (WPScan), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation. POC availability and active exploitation are distinct signals: here only POC is confirmed. SSVC framing would likely be: exploitation = PoC, automatable = yes (enumerating user IDs to harvest emails is scriptable), technical impact = partial. Net: a credible information-disclosure (email harvesting, including administrator addresses) flaw useful for reconnaissance and phishing, but not a direct compromise vector. Missing data: no EPSS and no KEV in the input, so exploitation-probability signals cannot be cross-checked.

An attacker self-registers a Subscriber account on a WordPress site running User Private Files before 2.1.9, then invokes the plugin's document-user operation while supplying arbitrary user IDs that do not belong to any document they own. Because the plugin fails to validate ownership, it returns the targeted account's email address, letting the attacker enumerate and harvest emails of all registered users including administrators. A public exploit is available via WPScan, making this straightforward to automate for targeted phishing or credential-stuffing preparation.