CVE-2026-97332: CWE-284 Improper Access Control in User Private Files
Description
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
Affected software
User Private Files
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-97332 identifies an improper access control vulnerability (CWE-284) in the User Private Files WordPress plugin before version 2.2.0. On multisite WordPress installations, the plugin's mechanism to route file requests through an access check via a rewrite rule does not function correctly. This flaw permits unauthenticated attackers to retrieve private files belonging to other users without authorization.
Potential Impact
Unauthenticated users can directly access private files of other users on multisite WordPress installations using the affected plugin versions. This exposure can lead to unauthorized disclosure of sensitive user data stored as private files.
Mitigation Recommendations
Upgrade the User Private Files plugin to version 2.2.0 or later, where this access control issue is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version boundary indicating the fix in 2.2.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-24T11:58:42.116Z
- State
- PUBLISHED
Threat ID: 6ac1f64ea43b0b3b8943476f
Added to database: 10/04/2026, 06:46:38 UTC
Last enriched: 10/04/2026, 07:01:11 UTC
Last updated: 10/04/2026, 09:37:36 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.