Prevent Files Access EUVD-2026-89919

Requires an authenticated account at Subscriber level (the lowest standard WordPress role) on a site running Prevent files / folders access <= 2.6.7; the plugin must be installed and actively configured to restrict one or more files/folders for the bypass to have meaning. Exploitation is limited by the authentication requirement (self-registration must be enabled or the attacker must otherwise obtain a Subscriber account) and by the confidentiality-only impact - the flaw discloses protected file contents but does not permit modification or denial of service. No user interaction is needed.

This is a genuine-but-low-priority issue. The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3, Medium) is internally consistent with the CWE-862 Missing Authorization classification and the 'Subscriber' role noted in the description: a low-privileged authenticated user (PR:L) can perform an action over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), yielding only a limited confidentiality impact (C:L) with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. The practical risk is bounded by three factors that all point downward: the attacker must already hold a valid Subscriber account, the impact is confined to bypassing the plugin's own file/folder access restriction (confidentiality-only), and the affected product is a niche WordPress access-control plugin rather than broadly deployed software. This is not a high-CVSS-but-hidden-danger case - the score itself is modest (4.3) and matches the real-world exposure. One labeling caveat: the 'Authentication Bypass' tag overstates the flaw, which is authorization bypass (broken access control, CWE-862), not authentication bypass - an authenticated Subscriber is required.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running Prevent files / folders access <= 2.6.7. Because the plugin fails to enforce a capability/authorization check on the protected resource, the Subscriber directly requests a file or folder the plugin was configured to restrict and retrieves its contents, bypassing the intended access control. No public exploit code is available and the impact is limited to disclosure of the protected files (confidentiality only, C:L).