---
id: CVE-2026-97332
title: >-
  The User Private Files  WordPress plugin before 2.2.0 does not properly
  protect its stored private files on multisite installations, where the rewrite
  rule it relies on to route file requests through its access check is never
  reached, al…
summary: >-
  The User Private Files  WordPress plugin before 2.2.0 does not properly
  protect its stored private files on multisite installations, where the rewrite
  rule it relies on to route file requests through its access check is never
  reached, al…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-284
product: User Private Files
affected:
  - user_private_files < 2.2.0
published: '2026-10-04'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T16:17:33.833'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97332'
references:
  - url: 'https://wpscan.com/vulnerability/d6a144b3-84e3-43eb-92d3-fd4505dd0e1c/'
    label: contact@wpscan.com
  - url: 'https://github.com/Kolya080808/CVE-2026-97332-PoC'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00259
epssPercentile: 0.17526
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Kolya080808/CVE-2026-97332-PoC'
  checkedAt: '2026-10-27T19:24:50.617Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-05T10:50:12.072095Z'
ingestedAt: '2026-10-04T06:55:02.311Z'
---

## Overview

The User Private Files  WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.