Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
medium
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without esc...
- CVSS:
- 5.3
- Affected:
- up to 2.8.8.8
- Fixed in:
- 2.8.8.9
- Disclosed:
- Aug 12, 2026
CVE-2026-3835 on NVD →
Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions
medium
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured capability check on the 'pda_lite_custom_permission_check' function in versions 2.8.6 to 2.8.8.2. This makes it possible for authenticated attackers, with Contri...
- CVSS:
- 5.4
- Affected:
- 2.8.6 – 2.8.8.2
- Fixed in:
- 2.8.8.3
- Disclosed:
- Apr 24, 2025
CVE-2025-3861 on NVD →
Prevent Direct Access – Protect WordPress Files <= 2.8.8 - Unauthenticated Sensitive Information Exposure
medium
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract...
- CVSS:
- 5.3
- Affected:
- up to 2.8.8
- Fixed in:
- 2.8.8.1
- Disclosed:
- Apr 24, 2025
CVE-2025-3923 on NVD →
Prevent Direct Access – Protect WordPress Files [prevent-direct-access] < 2.8.8.1
unknown
- Affected:
- up to 2.8.8.1
- Fixed in:
- 2.8.8.1
CVE-2025-3923 on NVD →
Prevent Direct Access – Protect WordPress Files [prevent-direct-access] >= 2.8.6 - <= 2.8.8.2
unknown
- Affected:
- 2.8.6 – 2.8.8.2
- Fixed in:
- 2.8.8.2
CVE-2025-3861 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database