Prevent Direct Access WordPress Plugin Incorrect Authorization Vulnerability

A vulnerability exists in the Prevent Direct Access – Protect WordPress Files plugin for WordPress, specifically in versions 2.8.6 prior to 2.8.8.2. The issue arises from a misconfigured capability check in the 'pda_lite_custom_permission_check' function, allowing authenticated attackers with Contributor-level access and above to unauthorized access and modification of media protection statuses.

Impact

Exploitation of this vulnerability allows for unauthorized access and modification of media protection statuses, potentially leading to unauthorized access to protected files.

Remediation

Users can update to version 2.8.8.3 or a newer patched version to address this vulnerability.