User Private Files

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:mediajedi:user_private_files:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

VendorMediajedi (2dd6fa18-b0f1-5bce-a9b0-79212313548a)
ProductUser Private Files (aa4cf7ed-fced-5e14-a28d-de2b44a1ad5c)
Edition*
Language*
Software edition*
Target softwarewordpress
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-7848 vulnerable 2026-06-08 06:58:23.678222 User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
MEDIUM (4.3)
The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to gain access to other user's private files.
Published: 2024-08-22T10:58:41.183Z
Updated: 2026-04-08T16:35:49.215Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-2356 vulnerable 2026-06-08 05:43:35.387222 User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.
Published: 2022-08-08T13:46:51.000Z
Updated: 2026-06-23T14:39:37.731Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.