Description
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.
Published: 2025-04-25
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Exposure
Action: Update Plugin
AI Analysis

Impact

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure due to insufficient randomness in the generate_unique_string function. This flaw allows unauthenticated attackers to determine the generated file name and thus retrieve protected files.

Affected Systems

Any WordPress installation running Prevent Direct Access – Protect WordPress Files version 2.8.8 or earlier is affected. The vulnerability is present in all legacy releases up to and including 2.8.8. The issue is tied to the plugin’s random file name generator used to protect uploaded files.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate level of risk. The EPSS score of less than 1% signals a very low probability of exploitation at the time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to guess or discover the weakly generated file name to exploit the weakness, suggesting that the attack vector is likely remote and unauthenticated.

Generated by OpenCVE AI on April 20, 2026 at 23:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Prevent Direct Access – Protect WordPress Files plugin to the latest release that fixes the random string weakness (any version newer than 2.8.8).
  • Reduce the set of files marked as protected by the plugin to the minimal required set and remove legacy or unused files from the protected list.
  • Enable logging for attempts to access protected files and review the logs regularly for unauthorized requests.

Generated by OpenCVE AI on April 20, 2026 at 23:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-12397 The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.
History

Fri, 25 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Apr 2025 05:30:00 +0000

Type Values Removed Values Added
Description The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.
Title Prevent Direct Access – Protect WordPress Files <= 2.8.8 - Unauthenticated Sensitive Information Exposure
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:33:30.856Z

Reserved: 2025-04-24T16:59:44.504Z

Link: CVE-2025-3923

cve-icon Vulnrichment

Updated: 2025-04-25T15:07:58.276Z

cve-icon NVD

Status : Deferred

Published: 2025-04-25T06:15:46.117

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-3923

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T23:15:06Z

Weaknesses