The User Private Files plugin for WordPress versions prior to 2.2.0 fails to enforce access control on multisite installations. The plugin relies on a rewrite rule to route file requests through an internal access check; on multisite deployments that rule never triggers, allowing any visitor to request a private file URL and obtain its contents. This flaw falls under CWE‑284 (Improper Access Control) and results in the direct disclosure of private user data without authentication.

Any WordPress install that has the User Private Files plugin (release earlier than 2.2.0) running on a multisite network is vulnerable. Single‑site configurations retain the rewrite rule and are not affected. Site operators should identify the plugin version and the presence of a multisite deployment to assess exposure.

The EPSS score of <1% indicates a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 5.3 reflects a moderate severity with significant impact on confidentiality, as attackers can retrieve private files without credentials. Until the plugin is upgraded or an equivalent mitigation is enforced, the risk remains tangible for affected multisite sites.