CVE-2025-8945 in Wp Edit Password Protected Plugin
Summary
by MITRE • 09/02/2026
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in versions of the Wp Edit Password Protected WordPress plugin prior to version 1.3.5 represents a critical authentication bypass flaw that undermines the intended security model for restricted content. The plugin is designed to restrict access to specific pages or posts by requiring users to enter a password, thereby creating an expectation of confidentiality and controlled access. However, the underlying implementation fails to enforce this protection mechanism consistently across all entry points within the WordPress application architecture. Specifically, while the standard front-end interface correctly prompts for credentials before displaying protected content, the REST API endpoints associated with these pages do not perform equivalent authentication checks. This discrepancy allows an attacker to bypass the password requirement entirely by directly querying the relevant REST API endpoint, thereby retrieving the full plaintext content of the restricted page without any form of authorization or credential validation.
From a technical perspective, this flaw stems from improper access control enforcement within the plugin's codebase when handling requests routed through the WordPress REST API framework. In many legacy or poorly maintained plugins, developers may implement security checks only for traditional HTTP request handlers while neglecting to hook into the REST API authentication filters such as rest_authentication_errors or similar hooks that govern data retrieval permissions. Consequently, the application treats authenticated and unauthenticated users identically when accessing protected resources via the API interface. This oversight violates fundamental principles of secure design where access control policies must be applied uniformly across all interfaces provided by an application. The vulnerability is classified under CWE-287 Improper Authentication because the system fails to correctly verify the identity of a user attempting to access sensitive data, and it also aligns with CWE-306 Missing Authentication for Critical Function as the critical function of retrieving protected content lacks necessary authentication checks in specific contexts.
The operational impact of this vulnerability is significant for organizations relying on WordPress sites to host confidential information such as internal documentation, client details, or proprietary business logic behind password walls. An attacker can exploit this flaw using simple HTTP requests via tools like curl or Postman without needing any prior knowledge of the site's structure beyond identifying the page ID or slug associated with the protected content. This leads directly to a complete compromise of confidentiality for the affected resources. Furthermore, because REST APIs are often used by modern front-end frameworks and mobile applications, this vulnerability could potentially be exploited in more sophisticated attack chains involving automated scraping tools or integration attacks that rely on programmatic access rather than manual browsing. The ease of exploitation means that even attackers with minimal technical expertise can gain unauthorized access to sensitive data, leading to potential regulatory violations under standards such as GDPR if personal data is exposed, or loss of intellectual property rights in commercial contexts.
To mitigate this vulnerability, administrators must immediately update the Wp Edit Password Protected plugin to version 1.3.5 or later where these authentication checks have been properly implemented for REST API endpoints. In cases where updating is not immediately feasible due to compatibility constraints with other plugins or custom themes, temporary mitigations should be employed at the web server level. This can include configuring a Web Application Firewall (WAF) to block unauthorized access attempts to specific REST API paths associated with password-protected content or restricting direct access to these endpoints via IP whitelisting if applicable. Additionally, security audits of WordPress plugins should prioritize verifying that authentication logic is consistently applied across both traditional page rendering and programmatic API interfaces to prevent similar bypasses in other components. Regular monitoring for unusual traffic patterns targeting REST APIs can also help detect exploitation attempts early, although patching remains the only definitive remediation strategy.