EUVD-2025-210740
GHSA-9ppj-ppgq-52c9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-exploitable with low complexity; PR:L reflects mandatory Contributor authentication; C:L bounds impact to protected content disclosure only.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.
AnalysisAI
Improper authorization in the PPWP - Password Protect Pages WordPress plugin (all versions ≤1.9.15) allows authenticated Contributor-level users to invoke the vulnerable can_access function, retrieve the site's master password, and bypass protection on any password-gated page, post, or partial content. The CVSS vector (PR:L) confirms exploitation requires at minimum a valid WordPress account with Contributor privileges, limiting but not eliminating real-world risk given that Contributor accounts are often granted to guest authors or untrusted parties. No active exploitation confirmed (not listed in CISA KEV); no public exploit code status confirmed from available data.
Technical ContextAI
The vulnerability is rooted in CWE-285 (Improper Authorization), specifically a missing or insufficient capability check in the plugin's can_access PHP function, which governs whether a given user may retrieve or validate a master password used across password-protected content. WordPress's capability system defines roles (Subscriber, Contributor, Author, Editor, Administrator), and Contributor is a low-trust role intended for draft authorship only; it should not have access to site-wide protection credentials. The plugin fails to assert a sufficiently privileged capability (e.g., edit_others_posts or higher) before returning sensitive master password data. The changeset at plugins.trac.wordpress.org/changeset/3486400 represents the upstream fix. No CPE string was provided, but the affected product is the 'PPWP - Password Protect Pages' plugin for WordPress, versions 0 through 1.9.15 inclusive.
RemediationAI
Update the PPWP - Password Protect Pages plugin beyond version 1.9.15 immediately. The upstream fix is available via the WordPress plugin repository changeset 3486400 (https://plugins.trac.wordpress.org/changeset/3486400/); the exact patched release version number is not independently confirmed from the available data, so administrators should update to the latest available version through the WordPress plugin updater, which will apply the corrected can_access capability check. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e041f0-3019-4d1f-b1a3-b40275c0966a should be consulted for confirmed fix version details. As a compensating control prior to patching, restrict Contributor-level account creation and audit existing Contributor accounts for untrusted parties. Disabling the plugin entirely eliminates exploitation but also removes content protection - weigh this trade-off based on site sensitivity.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today