CVE-2026-97332

5.3 Moyenne

Publiée le 04/10/2026 à 09:16 · Modifiée le 09/10/2026 à 18:17 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

Traduire en français

Produits concernés

Unknown User Private Files

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-284

Références

https://wpscan.com/vulnerability/d6a144b3-84e3-43eb-92d3-fd4505dd0e1c/
https://github.com/Kolya080808/CVE-2026-97332-PoC

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories