CVE-2026-97332 User Private Files CVE debrief

Who should care

Defenders managing WordPress multisite installations with the User Private Files plugin should assess exposure and prioritize updating to version 2.2.0 or later. This includes IT administrators, security teams, and operators responsible for maintaining WordPress installations. They should verify the presence of this vulnerability in their environments, monitor for potential exploitation attempts, and implement compensating controls if necessary.

Why it matters

CVE-2026-97332 allows unauthenticated users to access private files on WordPress multisite installations with the User Private Files plugin before version 2.2.0. Defenders should verify exposure, prioritize updates, and monitor for exploitation attempts.

• Potential unauthorized access to sensitive user data.
• Possible data breaches or leakage of private files.
• Need for verification of plugin version and multisite installation configuration.
• Potential impact on user trust and reputation.

Technical summary

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, allowing unauthenticated users to retrieve other users' private files directly due to a flawed rewrite rule. This vulnerability impacts WordPress multisite installations with the plugin installed, potentially leading to unauthorized access to sensitive user data. The vulnerability class is related to improper access control and file protection mechanisms. Defenders should prioritize verifying the presence of this vulnerability in their WordPress multisite installations and ensure the plugin is updated to version 2.2.0 or later.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress multisite installations and ensure the plugin is updated to version 2.2.0 or later.

Recommended defensive actions

• Verify the presence of the User Private Files WordPress plugin version 2.2.0 or later in your multisite installations.
• Restrict access to private files through alternative means, such as file permissions or access controls.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description and source reference indicate that the plugin's flawed rewrite rule allows unauthenticated access to private files on multisite installations. The vulnerability was reported by WPScan and documented in their vulnerability database. There are no known exploit details publicly available, but defenders should verify the presence of this vulnerability in their WordPress multisite installations. The CVE record was published on 2026-10-04T07:16:34.303Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.