CVE-2025-11244: Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing
The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTPCLIENTIP, and similar headers) to determine user IP addresses in the ppgetipaddress() function when the "Use transients" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the "Use transients" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11244?
CVE-2025-11244 has a high severity due to the potential for unauthorized access through IP address spoofing.
How do I fix CVE-2025-11244?
To fix CVE-2025-11244, update the Password Protected plugin to version 2.7.12 or later, which addresses this vulnerability.
What versions are affected by CVE-2025-11244?
CVE-2025-11244 affects all versions of the Password Protected plugin for WordPress up to and including version 2.7.11.
What type of attack is CVE-2025-11244 associated with?
CVE-2025-11244 is associated with unauthorized access attacks leveraging IP address spoofing.
Who is at risk with CVE-2025-11244?
Users of the Password Protected plugin for WordPress who have not updated beyond version 2.7.11 are at risk from CVE-2025-11244.