Medium
WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.
Announced Source revision 1
Original source ↗CVE-2026-90952
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90952
WP Edit Password Protected
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "WP Edit Password Protected",
"versions": [
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.7",
"versionType": "semver"
}
],
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-90952
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #7865 · Revision 1
- Added to Heist Feed
- Publisher date