Wp Edit Password Protected < 1.3.5 – Protection Bypass via REST API | CVE 2025-8945

Description

The plugin allows protecting page content, but this protection can be bypassed by using the REST API.

Proof of Concept

1. As an admin, create a new page and check the "Enable Conditional Display" option.
2. Log out and browse to the page: you can't see the body.
3. Browse to /wp-json/wp/v2/pages/[id]: you can see the page body.

Affects Plugins

wp-edit-password-protected

Fixed in 1.3.5

References

CVE

CVE-2025-8945

Miscellaneous

Original Researcher

Pierre Rudloff

Submitter

Pierre Rudloff

Verified

Yes

WPVDB ID

37cec6e0-a349-4cc7-971d-b370bc733ab6

Timeline

Publicly Published

2025-08-21 (about 1 year ago)

Added

2025-08-21 (about 1 year ago)

Last Updated

2025-08-21 (about 1 year ago)

Other

Published

Title

Published

2026-02-18

Title

Popup Builder < 4.4.3 - Unauthenticated Subscriber Removal via Predictable Tokens

Published

2017-01-04

Title

Stop User Enumeration <= 1.3.4 - Username Enumeration Bypasses

Published

2017-03-13

Title

Dtracker <= 1.5 - Unauthorised Contract Creation

Published

2015-04-09

Title

WP REST API (WP API) <= 1.2 - Post Revision Disclosure

Published

2026-07-21

Title

WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation