Really Simple Security logo

Log out
Get PRO

Latest

Access violation vulnerability in User Private Files – WordPress File Sharing Plugin 2.1.0

  • Severity: medium-risk
  • Status: Fixed
  • Publication: August 21, 2024

The User Private Files plugin for WordPress is not secure and can be easily accessed by attackers. This is because it does not properly check the ‘docid’ key, allowing anyone with subscriber-level access or higher to view private files of other users.

Detected in:

User Private Files – File Upload & Download Manager with Secure File Sharing fixed vulnerable versions:
User Private Files – Upload and Share Files with Secure WordPress File Manager fixed vulnerable versions:
User Private Files – Upload Documents & Secure File Sharing with Frontend File Manager fixed vulnerable versions:
User Private Files – WordPress File Sharing Plugin fixed vulnerable versions:

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.