CVE-2026-97331: CWE-200 Information Exposure in User Private Files

CVE-2026-97331 is an information exposure vulnerability in the User Private Files WordPress plugin versions prior to 2.1.9. The plugin fails to verify that the user requesting access to a document is the owner of that document before returning the associated user's email address. This flaw enables any authenticated user, such as a Subscriber, to retrieve the email addresses of other registered users, including those with administrative privileges.

The vulnerability exposes email addresses of registered users to any authenticated user, potentially facilitating targeted phishing or social engineering attacks. While it does not directly allow privilege escalation or code execution, the exposure of administrator email addresses increases the risk surface for further attacks.

Upgrade the User Private Files plugin to version 2.1.9 or later, where this validation issue has been addressed. Since no official patch link is provided, users should consult the plugin's official repository or vendor advisory for the fixed version. Until upgraded, restrict authenticated user roles or limit plugin usage to trusted users to reduce exposure.