CVE-2026-3835
Last modified
CVE-2026-3835 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| buildwps | Prevent Direct Access – Protect WordPress Files | <= 2.8.8.8 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-3835?
How severe is CVE-2026-3835?
How do I fix CVE-2026-3835?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-38344A NULL pointer dereference in the get_min_buffer_size functi…7.5
- CVE-2026-38345A Division-by-Zero vulnerability in the ff_sws_init_single_c…6.5
- CVE-2026-38346An integer overflow in the yuv2planeX_8_c() function (libsws…7.5
- CVE-2026-38347A heap overflow in the ff_sws_alphablendaway function (libsw…7.5
- CVE-2026-38348An integer overflow in the libswscale/utils.c component of F…7.5
- CVE-2026-38349An integer overflow in the hScale16To19_c() function (libsws…7.5
- CVE-2026-38350An integer overflow in the target_sws_fuzzer() function (lib…7.5
- CVE-2026-38360Directory Traversal vulnerability in fohrloop dash-uploader …9.8
- CVE-2026-38361Multiple unauthenticated denial-of-service (DoS) issues in f…7.5
- CVE-2026-3837An authenticated attacker can persist crafted values in mult…5.4
- CVE-2026-3838Unraid Update Request Path Traversal Remote Code Execution V…8.8
- CVE-2026-3839Unraid Authentication Request Path Traversal Authentication …7.3
Are you affected by CVE-2026-3835?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST