Executive brief
PPWP – Password Protect Pages is a WordPress plugin used to restrict access to pages via password protection. A vulnerability allows authenticated contributors to inject malicious PHP objects through page protection settings. While the plugin itself cannot be directly exploited for code execution, an attacker could leverage this to trigger attacks if other vulnerable plugins or themes are installed on the same WordPress site, potentially leading to data theft, file deletion, or unauthorized access.
Technical details
The vulnerability is a PHP Object Injection flaw (CWE-502: Deserialization of Untrusted Data) in the PPWP plugin versions up to 1.9.18. It occurs via unsafe deserialization of the 'post_protection_roles' parameter in the class-ppw-passwords.php file. The attack vector requires network access and valid WordPress authentication at Contributor level or above. An attacker can inject a malicious serialized PHP object; however, exploitation depends on the presence of a usable PHP Object Graph (POP chain) in other installed plugins or themes. If such a chain exists, an attacker could achieve arbitrary file deletion, information disclosure, or remote code execution. A patch is available in versions after 1.9.18.
Affected products
- WP Dev Shed PPWP – Password Protect Pages up to and including 1.9.18
Timeline
- 2026-08-23: disclosed