CVE-2026-3835 in Prevent Direct Access Plugin
Summary
by MITRE • 08/13/2026
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability exists within the Prevent Direct Access - Protect WordPress Files plugin, a widely used security tool designed to protect WordPress sites from unauthorized file access. This plugin implements a token-based system to restrict access to protected files, requiring valid tokens for file retrieval. The flaw lies in the `get_advance_file_by_url()` method which handles token validation for file downloads. The vulnerability affects all versions up to and including 2.8.8.8, representing a critical security weakness that undermines the plugin's core protection mechanism.
The technical implementation flaw stems from improper SQL query construction within the token validation process. When processing file requests, the method employs a SQL LIKE operator to search for matching tokens in the plugin's database table. However, the implementation fails to properly escape wildcard characters using WordPress's recommended `$wpdb->esc_like()` function. This omission creates an SQL injection-like vulnerability where attackers can manipulate the query by inserting SQL wildcard characters such as percent signs or underscores into the token parameter. The LIKE operator without proper escaping allows malicious input to match against any database record, effectively bypassing the token validation entirely.
The operational impact of this vulnerability is severe and far-reaching for WordPress site administrators who rely on this plugin for file protection. Unauthenticated attackers can exploit this weakness to download any protected file from the WordPress installation, potentially accessing sensitive data such as configuration files, user databases, backup files, or even the complete WordPress core files. This represents a complete bypass of the intended access controls and could lead to full site compromise, data leakage, or unauthorized modifications. The vulnerability is particularly dangerous because it requires no authentication and can be exploited through simple URL manipulation.
This vulnerability maps directly to CWE-89 SQL Injection and CWE-287 Improper Authentication, as it allows attackers to bypass authentication mechanisms through database query manipulation. From an ATT&CK framework perspective, this represents a privilege escalation technique under T1078 Valid Accounts and T1566 Phishing with Malicious Attachments, where the attacker gains access to protected resources without proper credentials. The vulnerability also aligns with T1213 Data from Information Repositories, as it enables unauthorized access to stored data within the WordPress file system. Organizations should immediately implement mitigations including patching to versions beyond 2.8.8.8, implementing additional access controls, and monitoring for suspicious file access patterns. The fix requires proper implementation of `$wpdb->esc_like()` function to escape wildcard characters in SQL LIKE queries, ensuring that user input cannot manipulate the database search behavior.