Password Protected CVE-2026-93293

Two concrete prerequisites must both hold: (1) the plugin's Freemius opt-in must already be complete - the normal state after an administrator clicks 'Allow & Continue' - because the vulnerable purchase-completion handler only processes the 'purchased_plan' parameter after opt-in; and (2) the attacker must have an authenticated account at subscriber level or above (PR:L), so sites that disable user registration or have no low-trust accounts are not exposed to the authenticated path. Notably the handler enforces no capability check, nonce, or purchase validation, so any such authenticated user can trigger it on any wp-admin request. Realization of impact also requires an administrator to subsequently view an admin page, but since the payload is stored in a persistent site-wide notice this is effectively inevitable rather than a meaningful limiting factor.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates a low-complexity network-reachable flaw requiring only low privileges, with a scope change reflecting that the injected script executes in the higher-privileged administrator's context. The authentication requirement is confirmed by PR:L - exploitation needs an authenticated subscriber-level (or above) account, which meaningfully limits exposure on sites that do not permit open/low-trust registration. No EPSS score was supplied, the CVE is not listed in CISA KEV, and none of the three references is working exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent stored XSS. The signals are internally consistent - there is no network-vs-local or auth conflict between the CVSS vector and the description. The main real-world driver is that the vulnerable Freemius purchase-completion handler fires on any wp-admin request from any authenticated user with no capability, nonce, or purchase validation once opt-in is complete, which lowers the practical bar considerably on sites with untrusted low-privilege users.

On a WordPress site running Password Protected <= 2.8.4 whose Freemius opt-in has been completed, an attacker who holds (or self-registers for) a subscriber-level account sends a wp-admin request containing a malicious 'purchased_plan' parameter; the handler stores it unsanitized in a persistent site-wide admin notice. The next time an administrator loads any standard admin page (e.g. their Profile page), the injected script executes in the admin's authenticated browser session, enabling account/session abuse. No public exploit code has been identified, though the mechanism is fully described by Wordfence.