Password Protected EUVD-2026-54377

Exploitation requires two site-level conditions to be met simultaneously: the vulnerable plugin version (2.6.8-2.8.3) must be installed and active, AND the plugin's internal 'Restrict REST API Access' option must be enabled by the site administrator. Sites that have the plugin installed but have not enabled the REST API restriction option are not affected by this specific flaw (though their REST API may already be open). No attacker-side prerequisites exist once those conditions are in place - the attack is unauthenticated, requires no user interaction, and targets the standard WordPress REST API endpoint available on all WordPress installations. Exploitation is limited to confidentiality: an attacker can read protected content and account identifiers but cannot modify data or affect availability.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-accessible, zero-authentication, trivially exploitable confidentiality breach - the vector accurately captures the attack surface. However, EPSS at 0.15% (4th percentile) sharply contrasts with that severity, suggesting automated or widespread exploitation has not materialized despite the public POC from WPScan. There is no CISA KEV listing. The practical risk profile is therefore: high potential impact for any site that installed this plugin specifically to protect sensitive content (i.e., the plugin's entire user base), but real-world exploitation pressure remains low at time of analysis. The regression history adds urgency - sites that applied the CVE-2024-0437 patch (upgrading to 2.6.7) and subsequently upgraded to 2.6.8-2.8.3 believing they were protected are silently re-exposed. The information exposed includes both content and account identifiers, which could facilitate credential stuffing or targeted phishing. No integrity or availability impact is indicated.

An attacker identifies a WordPress site using this plugin (discoverable via HTTP headers, page source, or automated scanning) and directly queries the site's REST API endpoint (e.g., GET /wp-json/wp/v2/posts) without any authentication. Because the plugin's REST API restriction fails silently, the API returns the full body of password-protected posts, pages, and account metadata. A publicly available POC from WPScan documents the specific endpoint and request pattern needed to extract this data.