CVE-2025-3861
Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured capability check on the 'pda_lite_custom_permission_check' function in versions 2.8.6 to 2.8.8.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to access and change the protection status of media.
Reserved 2025-04-21 | Published 2025-04-25 | Updated 2025-04-25 | Assigner WordfenceCWE-863 Incorrect Authorization
| 2025-04-24: | Disclosed |
Mattia Brollo
www.wordfence.com/...-3cf7-4fc6-a16f-45b40cedc721?source=cve
plugins.trac.wordpress.org/....8.2/includes/pda_lite_api.php
plugins.trac.wordpress.org/changeset/3279923/
Support options
