The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.
CVSS 3.1MEDIUM 6.5·Network·Low privileges·No interaction·EPSS 0.00347·Published 2025-08-14·Fixed in 1.9.11
The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cr…
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.00649·Published 2023-02-06·Fixed in 1.8.6
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API.
THREATIST.IORead the docs