CVE-2026-90952: WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Edit Password Protected WordPress pluginto a version that resolves this vulnerability.Fixed in 2.0.7
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using WP Edit Password Protected versions before 2.0.7 are exposed if they rely on the plugin's site-wide access mode to hide published posts or pages. The affected restriction is specifically bypassed through the WordPress REST API.
What does an attacker need to exploit the issue?
An attacker does not need authentication, user interaction, or special privileges. They can use the WordPress REST API to read content from published posts and pages that the site-wide access mode was intended to hide.
What is the impact of successful exploitation?
Successful exploitation exposes the contents of published posts and pages protected by the plugin's site-wide access mode. The available information indicates confidentiality impact only; it does not indicate content modification or service disruption.
How can I determine whether my site is affected?
Check whether WP Edit Password Protected is installed at a version before 2.0.7 and whether its site-wide access mode is configured to hide published content. If both are true, test whether unauthenticated requests to the WordPress REST API can retrieve those posts or pages.