{"id":"CVE-2026-3835","aliases":["EUVD-2026-57720","GHSA-xxpw-3xg9-qwph"],"status":"published","title":"Prevent Direct Access – Protect WordPress Files \u003c= 2.8.8.8 - Unauthenticated Protected File Access","description":"The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb-\u003eesc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00474,"percentile":0.41272,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2026-08-13T05:29:19Z","modified":"2026-08-14T19:09:56Z","products":[{"vendor":"buildwps","product":"prevent direct access – protect wordpress files"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c39d16f1-ce80-402c-8a36-f9070dc5f9c9?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/prevent-direct-access/trunk/includes/repository.php#L221"},{"url":"https://plugins.trac.wordpress.org/browser/prevent-direct-access/tags/2.8.8.4/includes/repository.php#L221"},{"url":"https://plugins.trac.wordpress.org/browser/prevent-direct-access/trunk/download.php#L377"},{"url":"https://wordpress.org/plugins/prevent-direct-access/"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3637502%40prevent-direct-access%2Ftags%2F2.8.8.9\u0026old=3524320%40prevent-direct-access%2Ftags%2F2.8.8.8"},{"url":"https://plugins.trac.wordpress.org/changeset/3637499/prevent-direct-access/trunk/includes/repository.php"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fprevent-direct-access/tags/2.8.8.8\u0026new_path=%2Fprevent-direct-access/tags/2.8.8.9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3835"},{"url":"https://wordpress.org/plugins/prevent-direct-access"},{"url":"https://github.com/advisories/GHSA-xxpw-3xg9-qwph"}],"sources":{"cve":[{"id":"CVE-2026-3835","title":"Prevent Direct Access – Protect WordPress Files \u003c= 2.8.8.8 - Unauthenticated Protected File Access","description":"The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb-\u003eesc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.","status":"published","published":"2026-08-13T05:29:19.702Z","modified":"2026-08-13T13:46:55.932Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-57720","description":"The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb-\u003eesc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.","status":"published","published":"2026-08-13T05:29:19Z","modified":"2026-08-13T13:46:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-xxpw-3xg9-qwph","title":"The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to...","description":"The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb-\u003eesc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.","status":"published","published":"2026-08-13T06:33:51Z","modified":"2026-08-13T06:33:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:10:24.70819Z"}],"nvd":[{"id":"CVE-2026-3835","description":"The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb-\u003eesc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.","status":"published","published":"2026-08-13T06:17:38.353Z","modified":"2026-08-14T19:09:56.813Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:37.217486Z"}]}}