Description

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-16T05:16:44.747Z",
  "pubdate": "2026-08-16T05:16:44.747Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress in all versions up to, and including, 1.9.20. The flaw resides in the ppw_free_set_password AJAX action, which fails to properly validate user-controlled keys during execution. This security oversight allows authenticated attackers with Contributor-level access and above to arbitrarily modify passwords on any password-protected post within the affected WordPress installation. Successful exploitation of this vulnerability directly compromises the confidentiality and access control mechanisms protecting restricted posts, granting unauthorized users full access to sensitive content previously shielded by password authentication. The risk implications include unauthorized privilege abuse and content exposure within the application ecosystem. Exploitation requires authenticated access at the Contributor privilege level, meaning an attacker must already possess a valid low-privilege account on the target WordPress site to interact with the vulnerable AJAX endpoint.",
  "technicalDetails": "The vulnerability is classified as an Insecure Direct Object Reference (IDOR) affecting the PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin across all versions up to, and including, 1.9.20. The root cause of the flaw stems from insufficient authorization checks and a complete lack of server-side validation on user-controlled input identifiers processed by the ppw_free_set_password AJAX action. When processing requests via this endpoint, the underlying codebase fails to verify whether the currently authenticated user possesses the appropriate administrative or editorial rights over the specific target object, namely the password-protected post being modified.\nThe attack flow proceeds as follows: First, an authenticated attacker holding a Contributor-level account interacts with the WordPress AJAX subsystem. The attacker crafts an HTTP request targeting the ppw_free_set_password AJAX action. Within this request, the attacker supplies a user-controlled parameter or key referencing the target post ID alongside a new password value. Because the vulnerable function lacks adequate input validation and ownership verification, the application accepts the supplied identifier and directly updates the password associated with the specified post in the database.\nFollowing this successful password update operation, the post-exploitation impact allows the attacker to bypass the intended access restrictions. Armed with the newly set password, the attacker can subsequently query and access the protected content of the targeted post, escalating their capability beyond their intended Contributor role boundaries. The vulnerable component involves the AJAX handler associated with the ppw_free_set_password function. The attack vector is exposed over the network via standard WordPress AJAX handling mechanisms, requiring valid authentication and a minimum of Contributor-level privileges to successfully trigger the flaw."
}