CVE-2025-11729
Deferred Deferred - Pending Action

Unauthorized Data Access in PPWP WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Wordfence

Description
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-09-08
AI Q&A
2026-08-19
EPSS Evaluated
2026-09-07
NVD
CVE-2025-11729
EUVD
EUVD-2025-210740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpwp password_protect_pages_posts_full_or_partial_content to 1.9.15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PPWP plugin for WordPress has an improper capability check in the can_access function. This allows authenticated attackers with Contributor-level access or higher to retrieve a master-password and access any password-protected content.

Detection Guidance

Check WordPress sites using the PPWP plugin version 1.9.15 or lower. Look for unauthorized access to password-protected content or unusual retrieval of master-passwords by Contributor-level users or above.

Impact Analysis

An attacker could gain unauthorized access to sensitive or private content that was meant to be restricted. This includes pages, posts, or partial content protected by passwords.

Compliance Impact

This vulnerability could lead to unauthorized access of protected data, potentially violating compliance requirements for data confidentiality and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Update the PPWP plugin to the latest version immediately. Remove Contributor-level access for users who do not need it. Review logs for suspicious activity related to password-protected content access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart