EUVD-2025-210833
GHSA-6x5q-x4xw-v9vx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated REST API bypass with read-only partial confidentiality impact; no integrity or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.
AnalysisAI
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Technical ContextAI
The affected plugin integrates with WordPress's content-editing flow to add password protection on a per-page/post basis, a layer on top of WordPress's native password functionality. WordPress 4.7+ exposes a REST API (typically at /wp-json/wp/v2/) that provides programmatic JSON access to posts, pages, and other content types. When a plugin adds custom access restrictions it must hook into REST API permission callbacks or response filters in addition to standard template-layer checks; failing to do so is a common WordPress-specific vulnerability pattern. This plugin neglects that secondary enforcement path, so a direct GET to a REST endpoint for a protected page returns the full content without prompting for - or validating - the password. The CPE string uses 'unknown' as the vendor field, indicating NVD has not yet assigned a canonical vendor slug. CWE is not assigned in the source data, but the root cause maps most precisely to CWE-284 (Improper Access Control) or CWE-862 (Missing Authorization).
RemediationAI
Update the Wp Edit Password Protected plugin to version 1.3.5 or later, which is the first version confirmed to address this bypass per the WPScan advisory (https://wpscan.com/vulnerability/37cec6e0-a349-4cc7-971d-b370bc733ab6/). If immediate upgrade is not possible, a compensating control is to disable the WordPress REST API for unauthenticated users using a separate plugin (e.g., 'Disable REST API') or by adding a custom permission callback via the 'rest_authentication_errors' filter - note this may break legitimate REST-dependent features such as Gutenberg block editor functionality. Alternatively, sensitive content can be temporarily moved behind authenticated user roles rather than password-only protection until the plugin is updated.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today