Uploaded files reachable by direct URL without login
Uploaded files can be opened by anyone with the direct URL, even when logged out, on Apache and Nginx sites.
Tier II · Emerging Problems that are still building up.
3 public reports · first reported 18 December 2023 · last reported 20 March 2025
What's going wrong
Several owners of this WordPress file plugin found that uploaded documents can be opened by anyone who has the direct file link, even when they are logged out.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 3 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.