WordPress Plugin Vulnerabilities

Prevent Files / Folders Access < 2.6.8 - Missing Authorization

Description

The Prevent Files / Folders Access plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.6.7. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
prevent-file-access
Fixed in 2.6.8

References

CVE
CVE-2026-97267
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/65f7add4-b231-43b3-9f88-1965218dd91a

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
gueco
Verified
No
WPVDB ID
bc408ab6-7c8a-487c-a20f-75652bf0d694

Timeline

Publicly Published
2026-09-30 (about 17 days ago)
Added
2026-09-30 (about 16 days ago)
Last Updated
2026-09-30 (about 16 days ago)

Other

Published
Title
Published
2025-07-16
Title
The Plus Addons for Elementor Pro < 6.3.7 - Missing Authorization
Published
2025-05-16
Title
Salon Booking Pro <= 10.10.2 - Missing Authorization
Published
2023-05-05
Title
WP Job Portal < 2.0.2 - Unauthenticated Settings Update
Published
2026-09-28
Title
All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
Published
2026-07-10
Title
Wallet for WooCommerce < 1.6.5 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action