CVE-2026-97332

Published 4 October 2026 · tracked since 4 October 2026

Description

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private f

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-86817
• CVE-2026-93549
• CVE-2026-17005
• CVE-2026-104119
• CVE-2026-104118
• CVE-2026-105123 HIGH 8.8
• CVE-2026-105124 MEDIUM 6.1
• CVE-2026-105125 LOW 3.7
• CVE-2026-105118 MEDIUM 4.7
• CVE-2026-97873

→ Open the live CVE board · all tools