Description

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T00:16:24.943Z",
  "pubdate": "2026-08-19T00:16:24.943Z",
  "executiveSummary": "The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to an unauthorized access of data security flaw affecting all versions up to, and including, 1.9.15. This vulnerability stems from an improper capability check within the access validation logic, specifically targeting the can_access function. The security defect allows authenticated attackers possessing low-privileged access, specifically Contributor-level roles and above, to bypass intended access controls. Consequently, malicious actors can successfully retrieve master-passwords and subsequently view any password-protected content managed by the plugin. The risk implication involves the complete confidentiality breach of restricted WordPress content and administrative credentials, undermining the access restriction mechanisms provided by the plugin.",
  "technicalDetails": "The vulnerability is rooted in an insufficient and improper capability check implemented within the can_access function of the PPWP: Password Protect Pages, Posts & Full or Partial Content plugin. The vulnerable component fails to properly validate whether the requesting user possesses the necessary administrative or publishing capabilities before executing authorization validation routines. The affected versions encompass all iterations of the plugin up to, and including, version 1.9.15. The exploitation requirements dictate that the attacker must possess authenticated access to the target WordPress instance, specifically at the Contributor privilege level or higher. Network exposure is standard HTTP/HTTPS interaction through the WordPress application layer where AJAX or internal function calls process access verification requests. The step-by-step attack flow proceeds as follows: First, an authenticated attacker with Contributor-level privileges interacts with the application endpoints that invoke the can_access function. Second, due to the absence of a stringent capability check, the function processes the request without enforcing appropriate permission validations for the calling user context. Third, the function executes and improperly discloses sensitive authorization data back to the caller. Fourth, the attacker extracts the master-password returned by the execution of the flawed logic. Finally, the attacker leverages the retrieved master-password to perform post-exploitation actions, gaining unauthorized access to view any password-protected pages, posts, or full and partial content that should otherwise be restricted to authorized users only."
}