Information Disclosure in User Private Files Plugin for WordPress
CVE-2026-97331
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-97331?
The User Private Files plugin for WordPress prior to version 2.1.9 contains a vulnerability that fails to restrict access based on user permissions. This allows any authenticated user, including those with minimal roles such as Subscriber, to retrieve the email addresses of other registered accounts within the system, including those of administrators. The lack of proper validation when accessing user-related documents can lead to potential privacy breaches and unauthorized exposure of sensitive information.
Affected Version(s)
User Private Files 0 < 2.1.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.