CVE-2026-97332

{
  "etk_id": "ETK-2026-602",
  "cve_id": "CVE-2026-97332",
  "display_id": "CVE-2026-97332",
  "ghsa_id": "GHSA-rgr9-g879-r5wm",
  "euvd_id": "EUVD-2026-92076",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated private-file exposure in User Private Files",
  "summary": "User Private Files versions before 2.2.0 can expose stored private files when used on WordPress multisite installations. An unauthenticated attacker may retrieve files belonging to other users if the affected plugin is installed in that configuration.",
  "mitigation": "Upgrade User Private Files to version 2.2.0 or later. Until it is upgraded, limit public access to affected multisite sites and protect exposed file paths at the web-server or network layer.",
  "vendor": null,
  "product": "User Private Files",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.2.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.2.0"
      ],
      "package_name": "User Private Files",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 5.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss_score": 0.002,
  "epss_percentile": 0.0936,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 22.08549465,
  "t0_at": "2026-10-04T06:00:24.076000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-04T23:56:28.393431+00:00",
      "days": 0.7472721924884259,
      "is_lower_bound": false,
      "measured_at": "2026-10-04T06:00:24.076000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-07T20:29:45+00:00",
      "days": 3.6037143981481483,
      "is_lower_bound": false,
      "measured_at": "2026-10-04T06:00:24.076000+00:00",
      "url": "https://github.com/Kolya080808/CVE-2026-97332-PoC"
    },
    "trigger_signal": {
      "at": "2026-10-04T06:00:24.076000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-04T06:00:24.076000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97332"
    }
  }
}