A regression in the Password Protected WordPress plugin allows unauthenticated users to bypass site security and access restricted content via the REST API.

This is a regression of a previously patched vulnerability. The plugin fails to properly enforce authorization checks on the REST API when specific options are enabled, permitting unauthenticated visitors to bypass the password gate and access protected pages and account identifiers.

This vulnerability carries a CVSS score of 7.5, indicating a high risk of unauthorized information disclosure. Successful exploitation allows unauthorized parties to bypass access controls intended to protect private or sensitive business content, potentially leading to data leaks and reputational damage.

Immediate Action: Update the Password Protected plugin to version 2.8.4 or later immediately.

Proactive Monitoring: Review access logs for unusual patterns of REST API requests, specifically those originating from unauthenticated sessions targeting protected content.

Compensating Controls: Temporarily disable the plugin or restrict access to the WordPress REST API via WAF rules until the patch can be applied.

Public Exploit Available: Unknown.

The recurrence of this vulnerability in a security-focused plugin is significant. Administrators must apply the update to version 2.8.4 immediately to restore the integrity of the site's access control mechanisms and prevent unauthorized exposure of sensitive content.