CVE-2026-0551: PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/PPWP – Password Protect Pagesto a version that resolves this vulnerability.Fixed in 1.9.18 - Configuration
Identify and remediate the PHP Object Injection vector caused by deserialization of untrusted input in the PPWP vulnerable parameter 'post_protection_roles' (authenticated users could exploit it for PHP object injection).
WordPress (PPWP – Password Protect Pages) post_protection_roles = not specified
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to the WordPress site with Contributor-level access or higher. Unauthenticated visitors are not described as able to exploit it.
Is the vulnerable plugin alone enough to cause code execution or other impact?
No known POP chain exists in the vulnerable PPWP plugin itself. Impact requires another installed plugin or theme to provide a compatible POP chain; the resulting impact depends on that chain and may include arbitrary file deletion, sensitive-data retrieval, or code execution.
What should be reviewed while remediation is pending?
Review WordPress accounts that have Contributor or higher privileges and identify installed plugins or themes that could provide a PHP object POP chain. Reducing or removing unnecessary Contributor-level access limits who can supply the vulnerable parameter.