CVE-2026-0551

Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.19

Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This issue occurs through the post protection roles parameter and can be exploited by authenticated users with Contributor-level access or higher. The impact depends on the presence of a POP chain (a sequence of gadgets used to achieve code execution or other malicious actions) within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update to a version newer than 1.9.18. Avoid using the post protection roles parameter until the update is applied.