PPWP Plugin CVE-2026-0551

Exploitation requires an authenticated WordPress session at Contributor level or above - this is not an unauthenticated attack. The CVSS vector PR:L confirms a low-privilege authenticated account is the minimum threshold. Beyond account access, a second independent condition must be satisfied: a Property-Oriented Programming (POP) chain must be available through at least one additional installed plugin or theme on the target WordPress site; the PPWP plugin itself contains no known POP chain, meaning exploitation is impossible against a site running PPWP in isolation. Non-default configurations are not required - any site with a Contributor-enabled account and a vulnerable co-plugin is at risk. Factors limiting exploitation include: the necessity of a Contributor or higher account (not available by default on all WordPress deployments), the dependency on a co-installed POP chain source, and the absence of a known public POC or documented gadget chain specific to this vulnerability at time of analysis.

The NVD-assigned CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects worst-case impact when a suitable POP chain is available, and Contributor-level access is the privilege floor - a relatively low bar on many community-driven WordPress sites that allow open registration. However, the critical moderating factor is the POP chain dependency: without a co-installed plugin or theme supplying gadgets, this vulnerability has confirmed zero exploitable impact. This creates a split-risk profile - for sites running only PPWP in isolation it is effectively a non-issue, while sites running PPWP alongside popular plugin stacks face meaningful risk. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists, and no public POC has been identified, suggesting exploitation has not yet been industrialized. SSVC signals point to limited exploitation activity and human-mediated (not automated) attack complexity given the POP chain prerequisite. The real-world priority is moderate-to-high for sites with diverse plugin stacks; lower for minimal installations.

An attacker who holds or obtains a Contributor-level WordPress account - obtainable through open site registration, credential stuffing, or social engineering - submits a crafted, serialized PHP payload as the value of the 'post_protection_roles' parameter via the plugin's post-editing interface. The server deserializes the payload without validation, instantiating attacker-chosen PHP objects; if a co-installed plugin such as a page builder or e-commerce extension exposes a usable POP chain, the resulting gadget chain executes, potentially deleting files, reading credentials from wp-config.php, or achieving remote code execution under the web server process. No public POC exploit has been identified at time of analysis, meaning exploitation currently requires attacker knowledge of a suitable POP gadget chain present on the target.