Protected files reachable via direct URL
Protected files stay reachable through direct upload URLs, so logged-out visitors can still open PDFs and images.
6 public reports · first reported 25 July 2015 · last reported 17 October 2019
What's going wrong
Site owners using Media Vault to restrict PDFs, images and audio report that restricted files can still be opened by anyone with the direct upload link. Some find PDFs left open to the public, others find multisite file paths exposed or protected images appearing in search results, and one saw an image shown to logged-out visitors. The gap defeats the purpose of restricting downloads on membership and private document sites. Because the plugin is no longer actively updated, owners lack a dependable fix and resort to hand-written server rules. There is clear room for a verification tool that tests every upload URL and a managed protection service for sites that need private files.
AI-assisted: written with the help of AI from the reports.
Products affected
Media Vault.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.