CVE-2026-97332

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)

CWE

CWE-284

Published

2026-10-04

Modified

2026-10-09

Record from

the NVD, synced 2026-10-19

References

• https://wpscan.com/vulnerability/d6a144b3-84e3-43eb-92d3-fd4505dd0e1c/
• https://github.com/Kolya080808/CVE-2026-97332-PoC

Check your stackJSON