CVE-2025-11729: PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with a Contributor-level account or a higher-privileged role. Unauthenticated visitors are not described as able to exploit it.
Which installations are affected?
The issue affects the PPWP: Password Protect Pages, Posts & Full or Partial Content WordPress plugin in versions up to and including 1.9.15.
What can a successful attacker access?
A Contributor or higher-level attacker can retrieve a master password and use it to access password-protected content. The stated impact is unauthorized disclosure of protected data.