Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Direct Access to Private Files
- ID
- WPSEC-2026-0150
- Plugin
- User Private Files – Secure File Sharing and Client Portal Plugin (user-private-files)
- Affected
- all versions before 2.2.0
- Remediation
- Update to 2.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Frontend File Manager & Sharing – User Private Files on WPSec AttackSurface
- Fix released
- Published
Description
The User Private Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.9. Private files in the upf-docs uploads directory were protected only by a rewrite rule that the plugin added to the site-root .htaccess file on activation. The rule was skipped when that file was not writable, with only an admin notice shown, and was never restored afterwards. On multisite networks the rule covered only the activating site's uploads path, so files under uploads/sites/<id>/upf-docs/ were never protected. On affected setups, unauthenticated attackers who know or obtain a file's URL can download other users' private files directly, without any authorization check.
References
- https://wpsec.com/vuln/WPSEC-2026-0150/
- https://plugins.svn.wordpress.org/user-private-files/tags/2.2.0/
- https://wordpress.org/plugins/user-private-files/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS