CVE-2025-3861: WordPress PDA Plugin Auth Bypass Flaw

CVE-2025-3861 Overview

CVE-2025-3861 is a broken access control vulnerability in the Prevent Direct Access – Protect WordPress Files plugin for WordPress. The flaw affects versions 2.8.6 through 2.8.8.2 and stems from a misconfigured capability check in the pda_lite_custom_permission_check function. Authenticated users with Contributor-level access or higher can access and modify the protection status of media files they should not control. The weakness is classified as incorrect authorization [CWE-863]. The issue was resolved in a patched release referenced by WordPress changeset #3279923.

Critical Impact
Contributor-level accounts can alter file protection settings on managed media, potentially exposing files intended to be restricted or removing protections applied by administrators.

Affected Products

Prevent Direct Access – Protect WordPress Files plugin version 2.8.6
Prevent Direct Access – Protect WordPress Files plugin versions 2.8.7 through 2.8.8.1
Prevent Direct Access – Protect WordPress Files plugin version 2.8.8.2

Discovery Timeline

2025-04-25 - CVE-2025-3861 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3861

Vulnerability Analysis

The Prevent Direct Access plugin exposes REST API functionality to manage file protection status on WordPress media library items. Access to this functionality is gated by the pda_lite_custom_permission_check callback defined in includes/pda_lite_api.php. The callback is intended to restrict privileged actions to administrators or users with sufficient rights over the target media. Instead, it grants access to any authenticated user meeting a low capability threshold, allowing Contributor-level accounts to invoke the API. The result is unauthorized read and modification of media protection state, which subverts the plugin's core security control.

Root Cause

The root cause is an incorrect authorization decision inside pda_lite_custom_permission_check. The function performs a capability check that does not properly bind the caller's privileges to the specific media object being modified. See the WordPress Plugin Code Snippet and the fix in WordPress Changeset #3279923 for the corrected authorization logic.

Attack Vector

An attacker must hold a valid WordPress account with Contributor privileges or higher. Contributor accounts are common on multi-author sites and can also be created through open registration flows. Once authenticated, the attacker sends REST API requests to the plugin's endpoints to enumerate protected media and toggle their protection status. No user interaction from an administrator is required, and the attack traverses the network via standard HTTP or HTTPS.

See the Wordfence Vulnerability Report for additional technical detail on the request flow.

Detection Methods for CVE-2025-3861

Indicators of Compromise

Requests from non-administrative user sessions to plugin REST endpoints under paths associated with pda_lite_api or Prevent Direct Access management routes.
Unexpected changes to media protection status recorded in WordPress post meta for attachments managed by the plugin.
Contributor or Author accounts issuing POST or PUT requests to plugin API endpoints outside of normal editorial workflows.

Detection Strategies

Audit WordPress access logs for authenticated REST API calls to endpoints registered by the Prevent Direct Access plugin from users below the Administrator role.
Compare current media protection settings against a known-good baseline to identify unauthorized toggling of protection state.
Review plugin version inventories to identify sites running versions 2.8.6 through 2.8.8.2.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized log platform and alert on REST calls to /wp-json/ routes owned by the plugin from low-privilege roles.
Monitor for creation of new Contributor accounts followed shortly by plugin API activity.
Track file download patterns for previously protected media to detect newly exposed content.

How to Mitigate CVE-2025-3861

Immediate Actions Required

Update the Prevent Direct Access – Protect WordPress Files plugin to a version newer than 2.8.8.2 that contains the fix from WordPress Changeset #3279923.
Review all Contributor, Author, and Editor accounts on affected sites and disable any that are unused or unrecognized.
Restore the intended protection status on any media whose settings may have been altered while the vulnerability was exposed.

Patch Information

The vendor addressed the flaw by correcting the capability check in pda_lite_custom_permission_check. The fix is published in WordPress Changeset #3279923 and shipped in the release following 2.8.8.2. Administrators should apply the update through the WordPress plugin manager or by deploying the patched plugin package.

Workarounds

Temporarily deactivate the Prevent Direct Access plugin on affected sites until the patched version can be installed.
Restrict new user registrations and require administrator approval for role assignments at or above Contributor.
Place the WordPress REST API behind an authenticating proxy or web application firewall rule that blocks plugin routes for non-administrative roles.

bash

# Configuration example: upgrade the plugin via WP-CLI on affected hosts
wp plugin update prevent-direct-access
wp plugin get prevent-direct-access --field=version