The Prevent Direct Access – Protect WordPress Files plugin for WordPress suffers from an improper authorization vulnerability (CWE-285) in the get_advance_file_by_url() method. This method uses a SQL LIKE operator for token lookup but fails to escape wildcard characters using $wpdb->esc_like(). Consequently, an attacker can supply SQL wildcard characters such as '%' as the token value, which matches any record in the plugin's file table. This flaw allows unauthenticated attackers to bypass the private token requirement and download any protected file. The vulnerability affects all versions up to and including 2.8.8.8. No official patch or remediation guidance is currently provided by the vendor.

An unauthenticated attacker can bypass the plugin's intended access controls and download any protected file. This leads to unauthorized disclosure of potentially sensitive files protected by the plugin. The vulnerability does not impact integrity or availability but compromises confidentiality of protected WordPress files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to protected files by alternative means. Avoid exposing sensitive files relying solely on this plugin's protection.