The User Private Files WordPress plugin prior to version 2.1.9 allows an attacker who is logged in, such as a Subscriber, to call the dpk_upvf_rmv_access function without first validating that the requested document belongs to the user. This omission causes the plugin to return the email address of any registered account, exposing sensitive personal information. The weakness is an information‑disclosure flaw (CWE‑200) that results from missing access‑control verification.

WordPress sites that have the User Private Files plugin installed with a version earlier than 2.1.9 are vulnerable and any authenticated user, such as a Subscriber, can obtain the email addresses of all registered accounts, including administrators.

The description explicitly states that any authenticated user, including a Subscriber, can invoke the dpk_upvf_rmv_access function to retrieve any registered account’s email address, with no additional permissions required. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.3 indicates moderate severity; however, the fact that the leak occurs within normal authenticated sessions underscores a persistent privacy risk to all site users.