The Prevent Direct Access – Protect WordPress Files plugin permits an attacker to retrieve any file that the plugin protects. The vulnerability is caused by the get_advance_file_by_url() method performing a SQL LIKE comparison against an unescaped token. An attacker can supply a wildcard character such as % as the token, which matches every record in the plugin’s file table and yields the content of arbitrary protected files. This flaw compromises the confidentiality of the protected data and could allow further exploitation, for example, by providing the attacker with application assets or private data.

Any WordPress installation running the Prevent Direct Access – Protect WordPress Files plugin version 2.8.8.8 or earlier requires attention. The plugin is distributed by buildwps. Sites that rely on this plugin to guard PHP, upload, or template files are at risk.

The CVSS score of 5.3 marks the issue as a moderate-security bug. EPSS is not available, so the current quantitative likelihood of exploitation cannot be derived, but the flaw requires only unauthenticated access and merely the ability to request a protected file URL with a wildcard token. The attack does not require elevated privileges and can be performed via the web browser or automated scripts. The plugin is not listed in the CISA KEV catalog, indicating no documented public exploitation as of the latest data.