Executive brief
The PPWP (Password Protect WordPress) plugin for WordPress is used to restrict access to specific pages or content using passwords. A security flaw in versions 1.9.19 and earlier allows users with 'Contributor' level access to bypass certain authorization checks. This could allow an internal user to interact with or modify data they should not have access to, potentially compromising the integrity of protected content.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the PPWP (Password Protect WordPress) plugin for WordPress in versions up to and including 1.9.19. The flaw is rooted in improper authorization checks (CWE-639) when handling user-controlled keys or object identifiers. An attacker with Contributor-level privileges can exploit this over the network without user interaction to bypass intended access controls. This could lead to unauthorized interaction with database objects or sensitive configuration settings. The issue is resolved in version 1.9.20.
Affected products
- WP Folio Team PPWP (Password Protect WordPress) <= 1.9.19
Timeline
- 2026-06-10: other: Reported by researcher Ananda Dhakal
- 2026-06-26: disclosed: Initial disclosure by Patchstack
- 2026-06-26: patched: Version 1.9.20 released to address the vulnerability