What the vulnerability does
01Description
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
Explanation of Vulnerability in Simple Terms
02Summary
The Prevent Direct Access plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to read sensitive file information over the network. The vulnerability affects versions up to 2.8.8.8. An attacker can access restricted file paths without logging in, potentially exposing configuration files or other protected content. Site administrators should update to a version newer than 2.8.8.8.
What an attacker can do
03Attacker Capabilities
Read sensitive file information without logging in.
Potential impact on your site
04Site Impact
Attackers can discover and read protected files, potentially exposing database credentials or configuration details.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 13, 2026
CVE published
August 13, 2026
Record updated
