Frontend File Manager & Sharing – User Private Files <= 1.1.0 - Sensitive Information Disclosure

Wordfence Intelligence   >   Vulnerability Database   >   Frontend File Manager & Sharing – User Private Files <= 1.1.0 - Sensitive Information Disclosure
5.3
Exposure of Sensitive Information to an Unauthorized Actor
CVSS 5.3 (Medium)
Publicly Published August 6, 2022
Last Updated December 5, 2022

Description

The Frontend File Manager & Sharing – User Private Files plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.1.0 via the dpk_upvf_uemail_search() function. This can allow unauthenticated attackers to extract sensitive data including user emails.

References

Share

Vulnerability Details for Secure Client Portal and Private File Sharing Plugin – User Private Files

Secure Client Portal and Private File Sharing Plugin – User Private Files

Software Type Plugin
Software Slug user-private-files (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.1.1, or a newer patched version
Affected Version
  • <= 1.1.0
Patched Version
  • 1.1.1

Recent vulnerabilities in Secure Client Portal and Private File Sharing Plugin – User Private Files

File Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter
6.4
CVE-2026-10093
Jun 15, 2026
Researcher: pham quang huy (Zibanana)
User Private Files – File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-13799
Feb 18, 2025
Researcher: Tim Coen
User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
4.3
CVE-2024-7848
Aug 21, 2024
Researcher: Peter Thaleikis
User Private Files < 2.0.5 - Insecure Direct Object Reference
5.3
CVE-2023-4836
Oct 11, 2023
Researcher: Dmitrii Ignatyev
WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-4636
Sep 4, 2023
Researcher: Shuning Xu
Frontend File Manager & Sharing – User Private Files <= 1.1.1 - Missing Authorization
6.3
CVE ID Unknown
Aug 6, 2022
Researchers:
Frontend File Manager & Sharing – User Private Files <= 1.1.2 - Subscriber+ Arbitrary File Upload
8.8
CVE-2022-2356
Jul 11, 2022
Researcher: Raad Haddad
# Title CVE ID CVSS Researchers Date
1 File Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter CVE-2026-10093 6.4 pham quang huy (Zibanana) June 15, 2026
2 User Private Files – File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-13799 6.4 Tim Coen February 18, 2025
3 User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access CVE-2024-7848 4.3 Peter Thaleikis August 21, 2024
4 User Private Files < 2.0.5 - Insecure Direct Object Reference CVE-2023-4836 5.3 Dmitrii Ignatyev October 11, 2023
5 WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-4636 4.4 Shuning Xu September 4, 2023
6 Frontend File Manager & Sharing – User Private Files <= 1.1.1 - Missing Authorization 6.3 August 6, 2022
7 Frontend File Manager & Sharing – User Private Files <= 1.1.2 - Subscriber+ Arbitrary File Upload CVE-2022-2356 8.8 Raad Haddad July 11, 2022
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation