CVE-2026-3835: 
WordPress vulnerability analysis and mitigation

CVE-2026-3835 is an improper authorization vulnerability in the "Prevent Direct Access – Protect WordPress Files" plugin for WordPress that allows unauthenticated attackers to bypass file access controls and download any protected file. The flaw exists in all versions up to and including 2.8.8.8, developed by buildwps. It was published on August 13, 2026, with a patch available in version 2.8.8.9. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-285 (Improper Authorization), with an additional estimate of CWE-89 (SQL Injection) due to the underlying mechanism. The vulnerable get_advance_file_by_url() method in includes/repository.php performs a SQL LIKE query to look up file access tokens without first escaping wildcard characters using WordPress's $wpdb->esc_like() function. An unauthenticated attacker can supply a SQL wildcard character such as % as the token value, which matches any record in the plugin's file table, effectively bypassing the private token requirement entirely. The vulnerable code path is visible in the plugin's Trac repository at line 221 of repository.php and line 377 of download.php (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated remote attacker to download any file that the plugin is configured to protect, bypassing all access controls. The primary impact is a confidentiality breach — sensitive documents, media, or other files intended to be restricted to authorized users can be freely accessed. There is no integrity or availability impact, and the vulnerability does not directly enable code execution or lateral movement, but exposure of sensitive files (e.g., credentials, proprietary documents) could facilitate further attacks (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at the time of disclosure (Wordfence). The EPSS score is 0.0, reflecting a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and low complexity, making it straightforward to exploit if a threat actor targets affected installations.

1. Reconnaissance: Identify WordPress sites using the "Prevent Direct Access – Protect WordPress Files" plugin version 2.8.8.8 or earlier. This can be done by checking the plugin's readme.txt file (e.g., https://target.com/wp-content/plugins/prevent-direct-access/readme.txt) or using web scanning tools.
2. Identify a protected file URL: Browse the target site to find a URL that the plugin protects with a private token (typically a URL containing a token parameter used to gate file access).
3. Craft a malicious request: Replace the legitimate token value in the file access URL with a SQL wildcard character such as %. For example: https://target.com/?pda_token=%&file=protected-document.pdf (exact parameter names may vary by plugin configuration).
4. Submit the request: Send the crafted HTTP GET request to the target site. The plugin's get_advance_file_by_url() method executes a SQL LIKE query using the supplied % token, which matches any record in the file table.
5. Download the protected file: The server returns the protected file without requiring a valid token, granting the attacker unauthorized access to the file's contents (GitHub Advisory, Wordfence).

• Network: HTTP GET requests to file download endpoints (e.g., URLs containing pda_token or equivalent token parameters) where the token value is a single % character or consists entirely of SQL wildcard characters (%, _).
• Logs: WordPress or web server access logs showing repeated requests to the plugin's download handler (download.php) with wildcard-only token values from unexpected or anonymous IP addresses.
• Logs: Unusual volume of successful file download responses (HTTP 200) for protected files from unauthenticated sessions or sessions without prior authentication activity.
• File System: No direct file system artifacts are expected from exploitation, as the attack is read-only; however, review server-side download logs for unexpected access to sensitive protected files (GitHub Advisory, Wordfence).

Update the "Prevent Direct Access – Protect WordPress Files" plugin to version 2.8.8.9 or later, which addresses the vulnerability by properly escaping wildcard characters in SQL token lookups using $wpdb->esc_like(). The patch changeset is publicly available in the plugin's Trac repository. As an interim measure, administrators should review web server and WordPress access logs for suspicious file download requests and consider implementing rate limiting or IP-based access controls on file download endpoints (GitHub Advisory, Wordfence).