What’s Vulnerable › Vulnerabilities

CVE-2026-97332: User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-04 · updated 2026-10-09
• Weakness: CWE-284

Description

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

Affected products

• User Private Files: before 2.2.0 — fixed in 2.2.0

How to fix

Upgrade to a fixed version: User Private Files 2.2.0. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/d6a144b3-84e3-43eb-92d3-fd4505dd0e1c/
• https://github.com/Kolya080808/CVE-2026-97332-PoC

Get alerted when CVE-2026-97332 or the next vulnerability affects your stack