Prevent Direct Access Protect Wordpress Files
Monthly
Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The `get_advance_file_by_url()` method in `includes/repository.php` performs token validation using a SQL `LIKE` clause without sanitizing input via `$wpdb->esc_like()`, meaning a request supplying `%` as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.
Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The `get_advance_file_by_url()` method in `includes/repository.php` performs token validation using a SQL `LIKE` clause without sanitizing input via `$wpdb->esc_like()`, meaning a request supplying `%` as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.