CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.
Explanation of Vulnerability in Simple Terms
The Prevent Direct Access plugin for WordPress exposes sensitive information through improper access controls. An unauthenticated attacker can read files or data that should be protected, potentially revealing configuration details or other non-public content. Update to a version newer than 2.8.8 to resolve this issue.
What an attacker can do
Read sensitive files or data that should not be publicly accessible.
Potential impact on your site
Sensitive WordPress configuration or plugin data may be exposed to anyone on the internet.
Conditions required to exploit
No authentication or user interaction required; attacker needs only network access.
Key dates
External resources
Related vulnerabilities
