The Prevent Direct Access – Protect WordPress Files plugin for WordPress versions up to 2.8.8 suffers from a CWE-200 sensitive information exposure vulnerability. The root cause is insufficient randomness in the 'generate_unique_string' function used to create file names for protected files. Because the file names are predictable, unauthenticated attackers can potentially determine these names and access files that should be protected by the plugin. This vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality only.

An attacker without authentication can potentially access sensitive files protected by the plugin by guessing or determining the insufficiently randomized file names. This leads to unauthorized disclosure of sensitive information. There is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to sensitive files by other means, such as web server configuration or additional access controls. Monitor vendor channels for updates and apply patches promptly once available.