EUVD-2026-57720
GHSA-xxpw-3xg9-qwph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Prevent Direct Access plugin active
-
DeliveryLocate or infer the plugin's file download endpoint URL
-
ExploitSubmit HTTP GET request with token parameter set to `%`
-
ExecutionSQL LIKE clause matches first record in plugin file table
-
ImpactServer returns protected file without credential validation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the Prevent Direct Access plugin installed and active in versions 2.8.8.8 or earlier, and at least one file must be enrolled in the plugin's protection system (i.e., the plugin's file table is non-empty). The attacker must be able to reach the WordPress file download endpoint over the network and know or discover the download URL structure - no authentication is required per CVSS PR:N. Exploitation does not require a specific server configuration beyond the plugin being active. Limiting factors: only files explicitly protected by this plugin are reachable; files stored elsewhere on the server or not registered with the plugin are unaffected. There is no user interaction required and no platform restriction beyond WordPress hosting. |
| Impact | The NVD CVSS 5.3 (Medium) score reflects the narrow, well-bounded impact: only files explicitly enrolled in the plugin's protection are reachable, and confidentiality impact is rated Low (C:L) with no integrity or availability consequence (I:N/A:N). However, from a business-risk perspective, the severity is functionally higher for any site relying on this plugin - its entire value proposition (protecting files) is nullified by a single-character token bypass. Attack complexity is genuinely low (AC:L): the exploit requires no brute force, no race condition, and no elevated position on the network; a single HTTP request with |
| Exploit ScenarioDerived | An attacker visits a WordPress site, identifies the Prevent Direct Access file download endpoint (e.g., via the predictable URL structure documented in the plugin's |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The get_advance_file_by_url() method in includes/repository.php performs token validation using a SQL LIKE clause without sanitizing input via $wpdb->esc_like(), meaning a request supplying % as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.
RemediationAI
Update the Prevent Direct Access plugin to version 2.8.8.9 or later immediately. The fix is confirmed in the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&new=3637502%40prevent-direct-access%2Ftags%2F2.8.8.9&old=3524320%40prevent-direct-access%2Ftags%2F2.8.8.8, which introduces proper $wpdb->esc_like() sanitization in repository.php. As a temporary compensating control before patching, administrators can add .htaccess or Nginx rules that block requests containing % (URL-encoded as %25) to the plugin's download endpoint path - note this may interfere with legitimate token URLs that contain percent-encoded characters and should be tested carefully. Alternatively, disabling the plugin eliminates the attack surface but also removes file protection, making previously protected files accessible via their original upload URLs. Neither workaround substitutes for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin's core function is to intercept direct file download requests and gate them behind a private token stored in a custom database table. The vulnerable code path, get_advance_file_by_url() in includes/repository.php (line 221), constructs a SQL query using WordPress's $wpdb abstraction with a LIKE operator to match the caller-supplied token against stored values. Because $wpdb->esc_like() is not called before interpolating the token into the query, MySQL wildcard characters - specifically % (matches any sequence of characters) and _ (matches any single character) - are passed through unescaped. A token value of % therefore satisfies the LIKE condition for every row in the table, returning the first matching record and granting access to its associated file. The CWE-285 (Improper Authorization) root cause is accurate: the authorization gate itself is bypassed rather than a secondary injection exploited. CPE cpe:2.3:a:buildwps:prevent_direct_access_-_protect_wordpress_files:*:*:*:*:*:*:*:* confirms the scope is the plugin by BuildWPS across all versions through 2.8.8.8.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint, trivially simple bypass (single wildcard character), no auth required, and confidentiality impact is bounded to plugin-managed files only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Prevent Direct Access - Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get_advance_file_by_url() method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token lookup without escaping wildcard characters via $wpdb->esc_like(). This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as %) as the token value, matching any record in the plugin's file table and downloading any protected file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB