User Private Files CVE-2026-97332

Exploitation requires the target to be a WordPress MULTISITE installation running User Private Files before 2.2.0 - on multisite the plugin's rewrite rule that routes file requests through its access check is never reached, exposing stored private files to direct retrieval. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and it works over the network against affected multisite sites. The principal limiting factor is the multisite precondition: standard single-site WordPress installations are not described as affected, and sites already upgraded to 2.2.0 or later are not vulnerable. Impact is limited to disclosure of other users' private files (no write or code-execution capability).

This is a genuine but moderate-severity access-control flaw (CWE-284), not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity access, and the vector is internally consistent with the description (unauthenticated users directly retrieving other users' private files over the network). However, several signals pull the real-world risk down: impact is limited to confidentiality only (C:L/I:N/A:N - information disclosure of private files, no code execution or integrity/availability loss), EPSS is very low at 0.14% (3rd percentile) indicating low predicted exploitation volume, and the issue is NOT on the CISA KEV list (no confirmed active exploitation). The mitigating factor that most constrains this flaw is that it only manifests on WordPress MULTISITE installations, where the plugin's rewrite rule that normally routes requests through its access check is never reached - standard single-site installs are not described as affected. Publicly available exploit code exists (via WPScan), which modestly raises opportunistic risk, but POC availability is distinct from active exploitation and should not be conflated with it. Net: a legitimate confidentiality bug worth patching on affected multisite deployments, but the low EPSS, absence from KEV, and multisite-only precondition make it a routine-patch item rather than an emergency.

On a WordPress multisite install running User Private Files before 2.2.0, an unauthenticated attacker requests the direct URL/path of a private file belonging to another user; because the plugin's rewrite rule that enforces the access check is never reached under multisite, the file is served directly. Publicly available exploit code (WPScan) demonstrates the request, lowering the barrier to opportunistic abuse.