Prevent Files Folders Access
Monthly
Broken access control in the miniOrange "Prevent files / folders access" WordPress plugin (versions through 2.6.7) lets an authenticated Subscriber - the lowest standard WordPress role - read the contents of files and folders the plugin is configured to protect. The condition is a missing-authorization flaw (CWE-862) scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so the impact is confidentiality-only: protected content can be disclosed, but nothing can be modified or taken offline. No KEV listing, public exploit code, or EPSS signal accompanies this disclosure, so no public exploit identified at time of analysis; practical risk depends on whether self-registration is enabled on the target site or the attacker otherwise holds a Subscriber account.
The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken access control in the miniOrange "Prevent files / folders access" WordPress plugin (versions through 2.6.7) lets an authenticated Subscriber - the lowest standard WordPress role - read the contents of files and folders the plugin is configured to protect. The condition is a missing-authorization flaw (CWE-862) scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so the impact is confidentiality-only: protected content can be disclosed, but nothing can be modified or taken offline. No KEV listing, public exploit code, or EPSS signal accompanies this disclosure, so no public exploit identified at time of analysis; practical risk depends on whether self-registration is enabled on the target site or the attacker otherwise holds a Subscriber account.
The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.