The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning (CVE-2026-97331)

What happened

An identified security flaw in the WordPress User Private Files plugin prior to version 2.1.9 has been publicly disclosed. The vulnerability arises because the plugin does not verify that a user requesting information is associated with the relevant document being accessed. As a result, when a user requests a document, the system may return the email address of any user, including administrators, without confirming their ownership of the document or their authorization to access this information. This flaw permits any authenticated user—such as a subscriber—to obtain sensitive email addresses of other users on the system. The issue has been assigned CVE-2026-97331 and is categorised as having medium severity, since it exposes private information but does not permit system control or other more severe exploits. The vulnerability exists in the WordPress User Private Files plugin versions prior to 2.1.9, and the underlying problem relates to insufficient validation during email address retrieval operations.

Who is affected

Organisations running affected deployments of the WordPress User Private Files plugin prior to version 2.1.9 are impacted by this security concern. Any site that utilises this plugin and allows authenticated users to access document-related information could potentially be exposed. This includes systems where user email addresses are considered sensitive. The vulnerability requires that users be authenticated before exploiting, meaning unauthenticated access via external means does not directly apply. No other product components or third-party plugins are indicated as affected by this specific flaw at this time.

Recommended actions

1. Verify the deployment of the WordPress User Private Files plugin in use; ensure it is upgraded to version 2.1.9 or later where the issue has been addressed.
2. Restrict user roles and permissions to limit access to document management features only to users with necessary authorisations, reducing the risk that authenticated users can exploit the flaw.
3. Monitor access logs for unusual activity related to email address queries or document access patterns that could indicate exploitation attempts.

Indicators of compromise

At this time, no specific indicators of compromise (IoCs) have been publicly disclosed for this vulnerability.