REST API Vulnerability in Password Protected Plugin for WordPress
CVE-2026-14943

Currently unrated

Key Information:

Vendor

WordPress
Status
Password Protected — Lock Entire Site, Pages, Posts, Categories, And Partial Content
Vendor
CVE Published:
7 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14943?

The Password Protected plugin for WordPress, prior to version 2.8.4, has a significant vulnerability that fails to secure REST API access for unauthenticated users when a specific option is enabled. This oversight allows unauthorized visitors to access protected content and account identifiers, effectively bypassing the site's password access controls. This issue re-emerged, despite previous fixes, highlighting the critical need for website owners to update to the latest version to ensure their site’s content remains secure.

Affected Version(s)

Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.6.8 < 2.8.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14943 - Proof of Concept

References

https://wpscan.com/vulnerability/874ada86-f13b-44f9-85e6-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Revanth Hari Narayana Matte
WPScan
.