CVE-2025-3923: Prevent Direct Access – Protect WordPress Files <= 2.8.8 - Unauthenticated Sensitive Information Exposure
First published: Fri Apr 25 2025(Updated: )
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Prevent Direct Access Protect WordPress Files | <=2.8.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3923?
CVE-2025-3923 is classified as a medium severity vulnerability due to the potential for sensitive information exposure.
How do I fix CVE-2025-3923?
To fix CVE-2025-3923, update the Prevent Direct Access – Protect WordPress Files plugin to version 2.8.9 or later.
What kind of vulnerability is CVE-2025-3923?
CVE-2025-3923 is a Sensitive Information Exposure vulnerability caused by insufficient randomness in generated file names.
Which versions are affected by CVE-2025-3923?
CVE-2025-3923 affects all versions of the Prevent Direct Access – Protect WordPress Files plugin up to and including 2.8.8.
Is CVE-2025-3923 exploitable by an attacker?
Yes, CVE-2025-3923 is exploitable by attackers who can leverage the weak randomness to access sensitive information.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/prevent direct access
- canonical/prevent direct access protect wordpress files