PT-2026-104111

CVE-2026-90952

Published

2026-10-02

Updated

2026-10-02

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Edit Password Protected WordPress plugin versions prior to 2.0.7

Description The plugin fails to enforce site-wide access restrictions on the WordPress REST API. This allows unauthenticated users to read the content of published posts and pages that were intended to be hidden by the site's access mode configuration.

Recommendations Update the plugin to version 2.0.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Artus Kg

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers