Skip to content
Sign in
4.3 Medium

CVE-2026-97331 The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document…

Description

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

Affected products and versions

Product Affected versions Fixed in
User Private Files 2.1 earliest → < 2.1.9 2.1.9

Other CVEs of User Private Files

The 2 CVEs of User Private Files →
CVE-2026-97332 The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite… 5.3 Medium
Track this CVE