WordPress · Prevent Direct Access – Protect Wordpress Files · CVE-2025-3861
**Name of the Vulnerable Software and Affected Versions**
Prevent Direct Access – Protect WordPress Files plugin versions 2.8.6 through 2.8.8.2
**Description**
The issue allows unauthorized access and modification of data due to a misconfigured capability check on the `pda lite custom permission check` function. This makes it possible for authenticated attackers, with Contributor-level access and above, to access and change the protection status of media.
**Recommendations**
For versions 2.8.6 through 2.8.8.2, consider disabling the `pda lite custom permission check` function until a patch is available to prevent unauthorized access and modification of data.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.