CVE-2025-3923

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-39245.3The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-pas CVE-2025-392407.2Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attacker CVE-2025-392454.7There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands v CVE-2025-392465.3There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially e CVE-2025-392478.6There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the ad CVE-2025-39257.8BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary p CVE-2025-39279.8Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address CVE-2025-39288.8Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault CVE-2025-39296.1An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message w CVE-2025-39306.3Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an atta CVE-2025-39317.8A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes t CVE-2025-39326.5It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird au