CVE-2026-14943 in Password Protected Plugin
Summary
by MITRE • 08/07/2026
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability exists within the Password Protected WordPress plugin version 2.8.4 and earlier, where a critical security flaw allows unauthenticated users to bypass sitewide password protection mechanisms through the REST API endpoint. This issue represents a significant regression that re-introduces a previously addressed weakness (CVE-2024-0437) which was initially patched in version 2.6.7 but subsequently broken in version 2.6.8, creating a persistent security gap in WordPress site protection strategies.
The technical flaw stems from improper access control implementation within the plugin's REST API handling logic. When the specific password protection option is enabled, the system fails to enforce authentication requirements for REST API requests that would normally be restricted to authorized users only. This allows malicious actors to directly query protected content through API endpoints without providing valid credentials, effectively circumventing the intended password protection mechanism.
The operational impact of this vulnerability is severe as it exposes sensitive information including private posts, pages, categories, and account identifiers to unauthorized access. Attackers can systematically enumerate protected content through REST API calls, potentially gaining insights into site structure, user accounts, and confidential data that should remain restricted. This creates opportunities for further attacks including credential harvesting, data exfiltration, and targeted exploitation of vulnerable users.
This vulnerability aligns with CWE-284 Access Control Issues and maps to ATT&CK technique T1566.001 Phishing via Service, as attackers can leverage the exposed information to craft more sophisticated social engineering campaigns. The regression demonstrates poor quality assurance practices in software version control and testing procedures, particularly around authentication and authorization mechanisms that are fundamental to web application security.
Organizations should immediately upgrade to plugin version 2.8.4 or later where this vulnerability has been addressed through proper REST API access restriction implementation. Additionally, administrators should implement network-level monitoring to detect unusual REST API traffic patterns and consider additional authentication layers such as WAF rules that can block unauthorized API access attempts. Regular security audits of WordPress plugins should include thorough testing of authentication controls and verification of patch effectiveness to prevent similar regressions in other security-critical components.
The vulnerability highlights the importance of maintaining comprehensive regression testing procedures for security patches, particularly when dealing with authentication mechanisms that are fundamental to application security architecture. Continuous monitoring and validation of access control implementations should be part of standard security operations to prevent such critical security gaps from persisting across software versions.