Insecure Object Reference Vulnerability in Password Protect Page Plugin by WordPress
CVE-2026-57634

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
PpWP
Vendor
CVE Published:
26 June 2026

What is CVE-2026-57634?

The Password Protect Page Plugin for WordPress has been found to exhibit vulnerabilities due to Insecure Direct Object References (IDOR) in versions up to 1.9.19. This flaw enables unauthorized users to gain access to sensitive data by manipulating requests. Website administrators using affected versions should prioritize upgrading to the latest release to mitigate potential exploitation risks.

Affected Version(s)

PPWP <= 1.9.19

References

https://patchstack.com/database/wordpress/plugin/password...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.