Skip to content
Sign in
5.3 Medium

CVE-2026-97332 The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite…

Description

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

Affected products and versions

Product Affected versions Fixed in
User Private Files 2.2 earliest → < 2.2.0 2.2.0

Other CVEs of User Private Files

The 2 CVEs of User Private Files →
CVE-2026-97331 The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document… 4.3 Medium
Track this CVE