Description

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-23T00:16:49.777Z",
  "pubdate": "2026-08-23T00:16:49.777Z",
  "executiveSummary": "An insecure deserialization vulnerability, specifically PHP Object Injection, exists in the PPWP – Password Protect Pages plugin for WordPress in all versions up to, and including, 1.9.18.\nThe vulnerability arises from the insecure handling of untrusted input supplied via the vulnerable parameter post_protection_roles.\nAuthenticated attackers possessing Contributor-level access and above can leverage this flaw to inject serialized PHP objects into the application context.\nAlthough the vulnerable software lacks an indigenous Property-Oriented Programming (POP) chain, the presence of a compatible POP chain within another installed plugin or theme on the target system enables successful exploitation.\nDepending on the specific characteristics of the available POP chain, successful exploitation can lead to severe security implications, including the deletion of arbitrary files, the retrieval of sensitive data, or the execution of arbitrary code.\nMitigation requires updating the affected plugin once a patched version is available or removing vulnerable components lacking adequate input sanitization.",
  "technicalDetails": "The vulnerability is rooted in the improper sanitization and validation of user-supplied data passed to the post_protection_roles parameter within the PPWP – Password Protect Pages plugin.\nWhen the application processes input from this vulnerable parameter, it insecurely passes the untrusted data into a PHP deserialization function, allowing an attacker to manipulate the object state.\nAll versions of the PPWP – Password Protect Pages plugin up to, and including, 1.9.18 are affected by this insecure deserialization flaw.\nExploitation of this vulnerability requires authentication, specifically demanding a minimum privilege level of Contributor access within the WordPress environment.\nThe attack flow begins with an authenticated attacker crafting a malicious serialized PHP object payload designed to leverage existing classes within the PHP application runtime.\nThe attacker submits this serialized payload via an HTTP request targeting the post_protection_roles parameter.\nUpon receiving the input, the vulnerable component deserializes the data without verifying its integrity or safety.\nBecause the PPWP – Password Protect Pages plugin does not contain a native POP chain, the vulnerability remains latent unless a secondary plugin or theme containing a valid gadget chain is concurrently installed and active on the target WordPress installation.\nWhen a supplementary POP chain is present, the deserialization process instantiates pre-existing classes in a sequence defined by the attacker, redirecting control flow during object destruction or wakeup magic methods.\nPost-exploitation impact is entirely contingent upon the specific capabilities exposed by the external POP chain, potentially permitting malicious actors to execute arbitrary code, perform arbitrary file deletion operations, or exfiltrate sensitive system and database information."
}