Comment by pentagrama
Comment by pentagrama 2 days ago
Ok, it was the Download Monitor plugin.
But I still have a few questions. What is WordPress’s default behavior? Does it prevent files uploaded to the media library from having public URLs? Are they only public once they are inserted into a published post? Images make sense because they are embedded, but what about a PDF linked inside a post? My understanding is that media files become publicly accessible as soon as they are uploaded, as long as someone knows or guesses the URL. I mean, the leak could have happened even without the plugin?
Correct. Files uploaded get stored in the wp-content/uploads folder and are public.