CVE-2026-3835 is a SQL wildcard injection vulnerability in the Prevent Direct Access (PDA) plugin that allows complete authentication bypass for file protection. When the plugin validates download tokens via SQL LIKE queries, the % and _ wildcard characters are not escaped before being used in the query. An unauthenticated attacker sending a token value of % matches all protected files in a single request — every file the plugin was meant to protect becomes downloadable.
The specific remediation is straightforward: wrap token values in esc_like() before using them in LIKE queries, or better yet, switch to exact-match lookups for token validation. WordPress provides esc_like() specifically because LIKE queries require specialized escaping distinct from standard SQL escaping — the function has existed since WordPress 2.5 (2008), making this a known edge case with tooling available for nearly two decades.
But the deeper problem is architectural, not incidental. Using LIKE for token validation in a security feature is fundamentally wrong by design. Tokens should be exact-match lookups, not pattern matching. The PDA plugin's architecture forced developers into a dangerous pattern as the standard workflow, multiplying the probability of escape failures across every code path touching this method. This wasn't a one-off developer mistake — it was a systemic design failure that made the bug inevitable.
The low EPSS score (0.00273) should not reassure you. It likely indicates narrow exploitation conditions or that attackers have quieter exploitation methods, not safety. This was a security-focused plugin that passed through multiple versions without detection, which suggests similar patterns likely exist elsewhere in the WordPress ecosystem unchecked. If you're auditing WordPress plugins or themes, treat any LIKE-based comparison on security-sensitive fields (tokens, keys, IDs) as a high-priority finding — specifically check whether the input is escaped with esc_like() or whether the code can be refactored to use exact-match lookups instead.