CVE-2026-97332: User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
User Private Filesto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
User Private Files installations running a version before 2.2.0 on WordPress multisite are affected. The described rewrite-rule failure is specific to multisite installations.
What does an attacker need to exploit it?
No authentication is required. An attacker must be able to request the stored private files directly, bypassing the plugin's intended access-check routing.
Are private files protected by the plugin's normal access controls on affected multisite sites?
No. On affected multisite installations, the rewrite rule used to send file requests through the access check is never reached, so other users' private files may be retrieved directly.