PPWP Password Protect Pages CVE-2026-3639

Exploitation requires an authenticated WordPress user account with at minimum contributor-level role, which grants the ability to create or edit draft posts and use shortcodes. The ppwp shortcode must be available to contributors on the target installation - this is the default behavior when the plugin is active. The stored payload fires automatically for any user who visits the injected page, with administrators being the highest-value targets due to their elevated site permissions. Exploitation is bounded by the PR:L requirement: unauthenticated users and subscribers cannot trigger this vector. Sites with open user registration, weak password policies, or many active contributor accounts face materially elevated risk. A privileged victim (e.g., an administrator) visiting the crafted page is required for maximum impact; if only lower-privileged users visit, the XSS impact is correspondingly reduced.

The NVD CVSS 3.1 score of 6.4 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring low privileges (PR:L) with changed scope (S:C) and low confidentiality and integrity impact. The S:C designation correctly models XSS crossing from the WordPress application boundary into victim browser sessions. However, the provided vector specifies UI:N, which is atypical for stored XSS - victim page access is a prerequisite, suggesting UI:R is more accurate; this metric discrepancy should be verified with Wordfence or NVD. No EPSS data was supplied, and the vulnerability is absent from CISA KEV with no known public proof-of-concept, materially reducing urgency. Real-world risk is moderate: contributor accounts are the lowest named role in WordPress above subscriber, and on sites with open user registration or multiple authors this barrier is meaningful but not high. The highest-impact realistic outcome is administrator session compromise via a cookie-stealing payload, which could culminate in full WordPress site takeover - making this a genuine priority for multi-author or open-registration deployments despite the medium base score.

An attacker registers or compromises a contributor-level WordPress account on a target site and creates a page embedding the ppwp shortcode with a JavaScript payload - such as a session-cookie exfiltration script - embedded in a shortcode attribute. When an administrator subsequently browses the page during routine site review, the stored script executes in their browser, silently forwarding the admin session token to an attacker-controlled endpoint. No public proof-of-concept has been identified, but the attack pattern is well-established for WordPress stored XSS and requires no novel technique.