WordPress Plugin Vulnerabilities

PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API

Description

The plugin allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.

Proof of Concept

Affects Plugins

Plugin icon
password-protect-page
Fixed in 1.9.11

References

CVE
CVE-2025-5998

Miscellaneous

Original Researcher
Pierre Rudloff
Submitter
Pierre Rudloff
Verified
Yes
WPVDB ID
17bad181-6cea-445e-b91c-22415d90743e

Timeline

Publicly Published
2025-07-24 (about 6 months ago)
Added
2025-07-24 (about 6 months ago)
Last Updated
2025-07-24 (about 6 months ago)

Other

Published
Title
Published
2022-12-29
Title
Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access
Published
2022-05-03
Title
Helpful < 4.5.15 - Votes Tampering
Published
2019-04-24
Title
WP Database Backup < 5.2 - Unauthenticated OS Command Injection
Published
2015-07-13
Title
CP Image Store with Slideshow <= 1.0.6 - Purchase ID Brute Force Prevention
Published
2014-08-01
Title
Captcha 2.12-3.8.1 - Captcha Bypass