WP Edit Password Protected CVE-2026-90952

Exploitation requires that the target site has installed WP Edit Password Protected prior to version 2.0.7 AND has configured the plugin's site-wide access mode to hide published posts and pages - the flaw only exposes content that this access restriction was meant to conceal. On such sites, no authentication, user interaction, or special configuration beyond the access mode is needed: the WordPress REST API returns the hidden content to any remote unauthenticated user. The limiting factor is the dependency on the access-mode feature being actively used to hide content; sites that do not rely on this plugin feature to restrict published content are not meaningfully impacted.

This is a moderate-severity information-disclosure issue rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, but impact is limited to confidentiality (C:L, I:N, A:N) - only the reading of content the operator intended to hide, with no integrity or availability effect, hence the base score of 5.3 (Medium). Publicly available exploit code exists (reported by WPScan), which raises practical likelihood, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation at time of analysis. No SSVC decision data was provided. The signals are internally consistent (network vector matches a REST API bypass), so no contradiction needs flagging; the main caveat is that real-world impact is entirely contingent on whether a given site actually relies on this plugin's access-mode feature to hide published content. Net: patch-worthy and easy to exploit, but bounded impact keeps it below critical-triage urgency.

An unauthenticated attacker identifies a WordPress site running WP Edit Password Protected before 2.0.7 that uses the plugin's site-wide access mode to hide published posts and pages. Instead of hitting the restricted front-end, the attacker queries the WordPress REST API (e.g. /wp-json/wp/v2/posts), which does not enforce the plugin's restriction, and reads the full content of the supposedly hidden posts and pages. Public exploit code from WPScan makes this trivial to reproduce.