CVE-2026-3835

Name of the Vulnerable Software and Affected Versions Prevent Direct Access – Protect WordPress Files versions prior to 2.8.8.9

Description Insufficient token validation in the get advance file by url() method allows unauthenticated attackers to gain unauthorized access to protected files. The issue occurs because the method employs a SQL LIKE operator for token lookup without escaping wildcard characters using $wpdb->esc like(). By providing SQL wildcard characters, such as %, as the token value, an attacker can bypass the private token requirement to match any record in the plugin's file table and download protected files.

Recommendations Update to a version newer than 2.8.8.8.