Description
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
buildwps Prevent Direct Access – Protect WordPress Files
Default version status: unaffected
0 to ≤ 2.8.8.8affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c39d16f1-ce80-402c-8a36-f9070dc5f9c9?source=cve ↗
- https://plugins.trac.wordpress.org/browser/prevent-direct-access/trunk/includes/repository.php#L221 ↗
- https://plugins.trac.wordpress.org/browser/prevent-direct-access/tags/2.8.8.4/includes/repository.php#L221 ↗
- https://plugins.trac.wordpress.org/browser/prevent-direct-access/trunk/download.php#L377 ↗
- https://wordpress.org/plugins/prevent-direct-access/ ↗
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3637502%40prevent-direct-access%2Ftags%2F2.8.8.9&old=3524320%40prevent-direct-access%2Ftags%2F2.8.8.8 ↗
- https://plugins.trac.wordpress.org/changeset/3637499/prevent-direct-access/trunk/includes/repository.php ↗
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fprevent-direct-access/tags/2.8.8.8&new_path=%2Fprevent-direct-access/tags/2.8.8.9 ↗