Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

WordPress Plugin Exposes Protected Files to Unauthenticated Attackers

CVE-2025-3923 · published 1 year ago
Summary

The Prevent Direct Access plugin for WordPress has a security issue that allows attackers to access sensitive files protected by the plugin. This can happen if the attacker guesses the file name. To fix this, update the plugin to the latest version.

Original advisory text
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string'...
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published25 Apr 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-3923 · NVD
Track software like this
Free during beta