Description

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T06:16:54.690Z",
  "pubdate": "2026-08-07T06:16:54.690Z",
  "executiveSummary": "The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin suffers from an access control vulnerability classified as an authentication bypass via the REST API.\nThis flaw impacts the Password Protected plugin in versions prior to 2.8.4, re-introducing a regression of a previously patched security defect tracked as CVE-2024-0437.\nThe vulnerability allows unauthenticated remote attackers to completely bypass sitewide password protection mechanisms when a specific plugin option is enabled.\nBy leveraging unauthorized endpoints exposed through the WordPress REST API, external actors can read otherwise-protected content, posts, pages, and account identifiers without possessing the required cryptographic or shared-secret credentials.\nThe risk implication is a total failure of the content gating security boundary, exposing sensitive or private information to the public internet.\nExploitation requires no prior authentication, low technical complexity, and network access to the target WordPress instance, specifically targeting the REST API routing logic.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate access control enforcement within the WordPress REST API integration of the Password Protected plugin.\nSpecifically, when a designated configuration option is enabled, the plugin fails to properly validate whether an incoming REST API request originates from an authenticated user or possesses the necessary session context to view locked material.\nThis represents a regression of CVE-2024-0437, which was initially introduced, patched in version 2.6.7, and inadvertently reintroduced in version 2.6.8.\nThe affected component is the REST API request handling and authorization filtering mechanism designed to enforce sitewide password gates.\nAffected versions include all iterations of the Password Protected plugin prior to 2.8.4.\nThe attack flow proceeds as follows: First, an unauthenticated visitor or attacker sends standard HTTP GET requests directly to the WordPress REST API endpoints corresponding to protected posts, pages, or user account listings.\nSecond, because the vulnerable plugin logic fails to intercept these specific REST API calls and enforce the password validation check, the WordPress core routing layer processes the request normally.\nThird, the REST API serializes and returns the restricted content and internal account identifiers in JSON format directly to the client.\nNetwork exposure is universal for any web application running the vulnerable plugin configurations over HTTP or HTTPS.\nNo privileges are required, and the attacker completely circumvents the password protection gate intended by site administrators.\nPost-exploitation impact includes the unauthorized disclosure of private posts, restricted pages, categorized content, and system account identifiers that can be leveraged for further reconnaissance or targeted attacks."
}