CVE-2026-97332
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
| Vendor | unknown |
| Product | user private files |
| Published | Oct 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown user private files
Be the first to know when new unknown vulnerabilities affecting unknown user private files are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / User Private Files
0 < 2.2.0
References
Credits
Akshat Parikh (SN1PER) WPScan