The WP‑Members Membership Plugin stores uploaded files in predictable directories without adequate access controls. This flaw allows anyone who can guess a user ID or file name to download private documents via direct URL, leading to potential confidentiality compromise. The underlying weakness is a file‑system-based access control error, classified as CWE‑552.

The vulnerability affects the WP‑Members Membership Plugin developed by cbutlerjr, versions up to and including 3.5.4.4, which is a WordPress plugin used on websites that rely on user‑generated content uploads.

With a CVSS score of 5.3 and an EPSS reflected as < 1 %, the risk and exploitation likelihood are moderate but not high. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it without authentication by constructing URL paths that follow the predictable storage pattern wp‑content/uploads/wpmembers/user_files/<user_id>/, provided they can enumerate or guess the required identifiers.