# CVE-2026-97267: WordPress Prevent files / folders access plugin broken access control

Source: https://junglewise.ai/threats/cve-2026-97267-subscriber-broken-access-control-in-prevent-files-folders-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-97267 · Severity: medium · CVSS 4.3 · Published 2026-09-30

The Prevent files / folders access WordPress plugin allows website administrators to restrict access to sensitive files and folders. A broken access control vulnerability in versions 2.6.7 and earlier allows subscriber-level users to bypass these restrictions and access files and folders they should not be able to see. This could expose sensitive data or private content to unauthorized users.

Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-97267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97267 being exploited in the wild.

**How severe is CVE-2026-97267?** Medium severity, with a CVSS score of 4.3, published 30 September 2026.

**Which products and versions are affected?** miniOrange Prevent files / folders access <=2.6.7.

**Is there a fix for CVE-2026-97267?** A patch was published on 2026-09-30: Fixed in version 2.6.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97267 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97267?** Check whether you run miniOrange Prevent files / folders access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control flaw in the Prevent files / folders access plugin versions up to 2.6.7 fails to properly enforce file and folder access restrictions for subscriber-level users. The vulnerability requires authentication as a subscriber to exploit, and allows attackers to access restricted resources via direct requests. The issue was fixed in version 2.6.8.

## Affected products

- miniOrange Prevent files / folders access <=2.6.7

## Timeline

- 2026-08-25: disclosed: Vulnerability reported
- 2026-09-30: advisory: Published by Patchstack
- 2026-09-30: patched: Fixed in version 2.6.8

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/prevent-file-access/vulnerability/wordpress-prevent-files-folders-access-plugin-2-6-7-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/prevent-file-access/vulnerability/wordpress-prevent-files-folders-access-plugin-2-6-7-broken-access-control-vulnerability?_s_id=cve)