Unauthorized Data Access in PPWP Plugin for WordPress

CVE-2025-11729

What is CVE-2025-11729?

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress exhibits a serious vulnerability due to the lack of adequate capability checks in its can_access function. This flaw allows authenticated attackers, holding Contributor-level access and above, to bypass security measures and gain access to sensitive password-protected content, including the retrieval of the master password. All versions up to and including 1.9.15 are affected, which poses a significant risk to the privacy and security of user data.

References