PPWP – Password Protect Pages
password-protect-page · plugin
Known security vulnerabilities for PPWP – Password Protect Pages. Find out in seconds which version runs on your site with WP Lens.
8 known vulnerabilities
2 exploitable without logging in · latest Aug 25, 2026
Listed on wordpress.org · latest 1.9.26 · last updated Oct 1, 2026 · 30K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 8.8
CVE-2026-0551contributor+≤ 1.9.18
PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
- Medium 6.4
CVE-2025-9878contributor+≤ 1.9.21
Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 6.4
CVE-2026-3639contributor+≤ 1.9.21
PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Medium 5.4
CVE-2026-32562login required≤ <= 1.9.15
WordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerability
- Medium 5.3
CVE-2024-11280unauthenticated≤ 1.9.5
PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- Medium 5.3
CVE-2024-0620unauthenticated≤ 1.8.9
PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass
- Medium 4.3
CVE-2025-10005contributor+≤ 1.9.20
Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update
- Medium 4.3
CVE-2026-57634contributor+≤ 1.9.19
WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).