WordPress Plugin Vulnerabilities

PPWP – Password Protect Pages < 1.9.16 - Contributor+ Master Password Disclosure via can_access

Description

The plugin is vulnerable to unauthorized access of data due to an improper capability check on the `can_access` function. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.

Affects Plugins

Plugin icon
password-protect-page
Fixed in 1.9.16

References

CVE
CVE-2025-11729
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e041f0-3019-4d1f-b1a3-b40275c0966a

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Athiwat Tiprasaharn (Jitlada)
Verified
No
WPVDB ID
70578b4e-cb68-4ed8-b8f6-3fc203f024fe

Timeline

Publicly Published
2026-08-18 (about 6 days ago)
Added
2026-08-18 (about 5 days ago)
Last Updated
2026-08-18 (about 5 days ago)

Other

Published
Title
Published
2026-07-06
Title
Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
Published
2024-10-11
Title
Elementor Addon Elements < 1.13.9 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections
Published
2026-05-19
Title
Kirki < 6.0.7 - Subscriber+ Sensitive Data Exposure via kirki_wp_admin_get_apis Action
Published
2025-09-22
Title
Envíos Coordinadora Woocommerce <= 1.2.0 - Unauthenticated Sensitive Information Exposure
Published
2026-08-06
Title
WP 7.0.x - Unauthenticated Password Protected Post Comment Disclosure via Gutenberg Latest Comments Block