EUVD-2026-54377
GHSA-qmm8-q2c2-c4m3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST API, no authentication required, no user interaction; high confidentiality loss of gated content; AC:L because attack requires no attacker-engineered conditions beyond site running vulnerable version.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Password Protected - Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.
AnalysisAI
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two site-level conditions to be met simultaneously: the vulnerable plugin version (2.6.8-2.8.3) must be installed and active, AND the plugin's internal 'Restrict REST API Access' option must be enabled by the site administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-accessible, zero-authentication, trivially exploitable confidentiality breach - the vector accurately captures the attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site using this plugin (discoverable via HTTP headers, page source, or automated scanning) and directly queries the site's REST API endpoint (e.g., GET /wp-json/wp/v2/posts) without any authentication. Because the plugin's REST API restriction fails silently, the API returns the full body of password-protected posts, pages, and account metadata. … |
| Remediation | Update the plugin to version 2.8.4 or later, which re-applies the REST API access restriction that was lost in 2.6.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit WordPress sites running 'Password Protected - Lock Entire Site' plugin versions 2.6.8 through 2.8.3 using plugin inventory tools or manual verification, and review access logs for REST API requests from external IP addresses. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today