Executive brief
Wp Edit Password Protected is a WordPress plugin that protects page content behind a password requirement. The plugin fails to enforce its protection checks when content is accessed through WordPress's REST API, allowing unauthenticated attackers to read protected page bodies without providing credentials.
Technical details
The vulnerability is an authentication bypass in the Wp Edit Password Protected WordPress plugin before version 1.3.5. When a page has conditional display protection enabled, the plugin correctly blocks direct access to the page content via the standard WordPress frontend. However, the protection mechanism is not applied to REST API endpoints (/wp-json/wp/v2/pages/[id]), allowing an attacker to retrieve protected page content by directly querying the REST API without authentication or password validation. This is a classic case of inconsistent security enforcement across different API surfaces in WordPress.
Affected products
- Wp Edit Password Protected Wp Edit Password Protected before 1.3.5
Timeline
- 2025-08-21: disclosed
- 2025-08-21: patched: Fixed in version 1.3.5