Vulnerabilities / Frontend File Manager & Sharing – User Private Files / WPSEC-2026-0151
Frontend File Manager & Sharing – User Private Files <= 2.1.9 - Unauthenticated Sensitive Information Exposure via Attachment Pages
Medium 5.3
CWE-200Fixed in 2.2.0
- ID
- WPSEC-2026-0151
- Plugin
- User Private Files – Secure File Sharing and Client Portal Plugin (user-private-files)
- Affected
- all versions before 2.2.0
- Remediation
- Update to 2.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Frontend File Manager & Sharing – User Private Files on WPSec AttackSurface
- Fix released
- Published
Description
The User Private Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.9. The plugin stores private files as unattached media attachments and did not block their public WordPress attachment pages (?attachment_id=<id>). This makes it possible for unauthenticated attackers to enumerate attachment IDs and view the titles, descriptions and file URLs of other users' private files. On sites with attachment pages disabled, WordPress redirects to the file URL instead.
References
- https://wpsec.com/vuln/WPSEC-2026-0151/
- https://plugins.svn.wordpress.org/user-private-files/tags/2.2.0/
- https://wordpress.org/plugins/user-private-files/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS