The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Prevent Direct Access Plugin | — | Update prevent-direct-access plugin to version 2.8.8.9, or a newer patched version | Aug 13, 2026 | Aug 12, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub