CVE-2026-3835: Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl() method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token lookup without escaping wildcard characters via $wpdb->esclike(). This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as %) as the token value, matching any record in the plugin's file table and downloading any protected file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3835?
CVE-2026-3835 has a medium severity rating of 5.3.
What are the consequences of CVE-2026-3835?
CVE-2026-3835 allows unauthorized access to protected files due to insufficient token validation.
How do I fix CVE-2026-3835?
To fix CVE-2026-3835, update the Prevent Direct Access – Protect WordPress Files plugin to the latest version.
Which versions are affected by CVE-2026-3835?
CVE-2026-3835 affects all versions of the Prevent Direct Access – Protect WordPress Files plugin up to and including 2.8.8.8.
What is the primary vulnerability in CVE-2026-3835?
The primary vulnerability in CVE-2026-3835 is the use of a SQL LIKE operator for token validation in the get_advance_file_by_url() method.