CVE-2026-3835 Overview
CVE-2026-3835 affects the Prevent Direct Access – Protect WordPress Files plugin for WordPress. The plugin fails to properly validate access tokens in the get_advance_file_by_url() method across all versions up to and including 2.8.8.8. The flaw stems from using a SQL LIKE operator for token lookups without escaping wildcard characters through $wpdb->esc_like(). Unauthenticated attackers can submit SQL wildcard characters such as % as the token value, matching arbitrary records in the plugin's file table and downloading any protected file. The vulnerability is classified as Improper Authorization [CWE-285].
Critical Impact
Unauthenticated attackers can bypass the private token requirement and download any file protected by the plugin, leading to disclosure of confidential documents, member-only downloads, and other restricted assets.
Affected Products
- Prevent Direct Access – Protect WordPress Files plugin
- All versions up to and including 2.8.8.8
- WordPress sites relying on the plugin for file access control
Discovery Timeline
- 2026-08-13 - CVE-2026-3835 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-3835
Vulnerability Analysis
The Prevent Direct Access plugin enforces file protection by generating a private token that gates downloads. The get_advance_file_by_url() method in includes/repository.php queries the plugin's file table to resolve requested downloads. That query compares the supplied token against stored values using SQL LIKE without first escaping wildcard metacharacters. As a result, the % character retains its wildcard meaning inside the query and matches any stored token.
An attacker who sends a request with a token value of % bypasses the intended access check. The database returns the first matching file record, and the download handler in download.php serves the associated protected file. No authentication, user interaction, or prior knowledge of a valid token is required.
Root Cause
The root cause is missing input sanitization for SQL wildcard characters before the token is concatenated into a LIKE clause. WordPress provides $wpdb->esc_like() specifically to neutralize % and _ characters in LIKE comparisons, but the vulnerable method does not call it. Combined with the use of LIKE instead of a strict equality operator, the missing escape converts a token check into a wildcard match against every record in the file table.
Attack Vector
Exploitation occurs over the network against the public download endpoint. The attacker issues an unauthenticated HTTP request to the plugin's download URL with % supplied where a valid private token would normally appear. The vulnerable LIKE clause resolves to a match on any stored token, and the server responds with the contents of a protected file. See the Wordfence CVE Vulnerability Analysis and the vulnerable code in repository.php for technical details.
No verified public exploit code is available. The vulnerability mechanism is described in prose only.
Detection Methods for CVE-2026-3835
Indicators of Compromise
- Web server access logs containing requests to plugin download endpoints with %, _, or URL-encoded %25 characters in the token parameter.
- Unexpected downloads of files marked as protected by the Prevent Direct Access plugin from unauthenticated source IPs.
- Bursts of sequential download requests from a single IP targeting the plugin's download handler.
Detection Strategies
- Review WordPress access logs for requests to download.php or the plugin's download rewrite endpoint containing wildcard characters in the token position.
- Correlate download events with authentication state; unauthenticated downloads of restricted files indicate exploitation.
- Alert on high-volume, low-diversity token values submitted to plugin download URLs.
Monitoring Recommendations
- Enable request logging on the WordPress web server and forward logs to a central analytics platform for pattern analysis.
- Add a Web Application Firewall (WAF) rule that flags % or _ characters in the plugin's token parameter.
- Monitor plugin version inventory across WordPress deployments and alert when versions at or below 2.8.8.8 remain installed.
How to Mitigate CVE-2026-3835
Immediate Actions Required
- Update the Prevent Direct Access – Protect WordPress Files plugin to a version above 2.8.8.8. The fix is present in version 2.8.8.9 per the WordPress changeset comparison.
- Audit web server and plugin logs for prior requests containing wildcard characters in the token parameter.
- Rotate or invalidate existing private tokens if unauthorized access is suspected.
Patch Information
The vendor fixed the issue in version 2.8.8.9. The corrective change is documented in the WordPress changeset update to includes/repository.php. Administrators should install the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Temporarily deactivate the Prevent Direct Access plugin until the update is applied, and restrict access to protected files through web server rules.
- Deploy a WAF rule that blocks requests to the plugin's download endpoint when the token parameter contains % or _.
- Restrict access to sensitive protected files through server-level authentication such as HTTP Basic Auth until patching is complete.
# Update the plugin using WP-CLI
wp plugin update prevent-direct-access
# Verify the installed version is 2.8.8.9 or later
wp plugin get prevent-direct-access --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
