CVE-2025-11729
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress up to version 1.9.15 is vulnerable to unauthorized data access due to improper capability check on the can_access function. Authenticated attackers with Contributor-level access can retrieve a master-password and access any password-protected content.
Risk Assessment
An attacker could gain access to protected content, including sensitive data, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the PPWP plugin to the latest patched version and review user permissions to restrict access to the can_access function.
Original NVD description (English source)
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.