Protect Uploads

Protect Uploads has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 4.8 out of 10.

The most common weakness is Improper Authorization, behind 1 of the records (100%).

The one issue recorded for Protect Uploads has a vendor fix available, so running the current release closes it.

Protect Uploads is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Protect Uploads vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.8

Protect uploads <= 0.3 - Authorization Bypass

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Protect Uploads banner
Latestv0.7.1

Protect Uploads

Protect Uploads

Author

Protect Uploads

4.8(12)
96/100
Last Updated
2026-08-28 (15d ago)
Active Installs
30,000+
Downloads
1,531,992
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2015-03-31 (12y ago)

The uploads directory is where the files of the WordPress library are stored. Unfortunelty, this directory is not protected. A person who wants to see all your library could list it instantly going to : http://yourwebsite/wp-content/uploads . This plugin will hide the content by adding an index.php file on the root of your uploads directory or by setting an htaccess which will return a 403 error (Forbidden Access). Depending on your server setting, the htaccess option could be disabled. New in Version 0.7.0: Site Health checks: See at a glance — under Tools → Site Health — whether your uploads directory is protected from browsing, what server you are running, and whether any risky file types are sitting in your uploads folder. WordPress 7.0 ready: Fully tested on WordPress 7.0 and PHP 8.3. All features: Directory Protection: Stop visitors from browsing your uploads directory (index.php or .htaccess 403). Image Watermarking: Add text watermarks to your uploaded images with customizable position, opacity, and font size. Right-Click Protection: Prevent users from right-clicking to download or save your images. Password Protection: Secure individual media files with passwords. Multiple passwords can be set for each file with custom labels. Access Logging: Track who accesses your password-protected files with detailed logs including IP address and user agent. Site Health Checks: Built-in protection status tests with actionable advice. Need more protection? Protect Uploads Pro adds image watermarks with bulk operations, expiring download links, role-based access with server-level enforcement, hotlink protection, download analytics, and a Protected Download block. Available languages: English Français Español Italian (thanks to Marko97)

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C