PHP Object Injection Vulnerability in Password Protect Pages Plugin for WordPress

CVE-2026-0551

What is CVE-2026-0551?

The Password Protect Pages plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input originating from the 'post_protection_roles' parameter. This vulnerability affects all versions up to and including 1.9.18 and allows authenticated attackers with Contributor-level access or higher to inject malicious PHP objects. Importantly, the presence of this vulnerability does not pose an immediate threat as there is no known PHP Object Injection chain within the plugin itself. However, if additional plugins or themes with exploitable POP chains are installed, the attackers could potentially delete files, access sensitive information, or execute arbitrary code, depending on the specific capabilities of the POP chain. It’s essential for site administrators to update to the latest version of the plugin and apply security best practices to mitigate risks.

References