CVE-2026-0551
Received Received - Intake

PHP Object Injection in PPWP Password Protect Pages WordPress Plugin

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: Wordfence

Description
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-0551
EUVD
EUVD-2026-64607

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence ppwp_password_protect_pages to 1.9.18 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PPWP – Password Protect Pages WordPress plugin up to version 1.9.18 has a PHP Object Injection vulnerability. It occurs when untrusted input from the 'post_protection_roles' parameter is deserialized. Authenticated attackers with Contributor-level access or higher can exploit this to inject a PHP Object. However, exploitation requires another installed plugin or theme containing a POP chain to have any impact.

Detection Guidance

Detecting this vulnerability requires checking for the vulnerable PPWP plugin version (up to 1.9.18) in WordPress. Inspect plugin files for the 'post_protection_roles' parameter usage. Review WordPress logs for suspicious deserialization activity or unauthorized file access attempts.

Impact Analysis

If a POP chain exists in another installed plugin or theme, attackers could delete arbitrary files, retrieve sensitive data, or execute code on your system. Without a POP chain, the vulnerability has no direct impact beyond potential object injection.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR or HIPAA if exploited to retrieve sensitive data or execute unauthorized actions. Since it allows authenticated attackers to inject PHP objects, it may lead to unauthorized access to personal or protected health information if a POP chain is present in another installed plugin or theme.

Mitigation Strategies

Immediately update the PPWP plugin to the latest version beyond 1.9.18. If an update is unavailable, disable or remove the plugin. Audit user roles with Contributor access or higher. Monitor for unusual activity and ensure no POP chain plugins are installed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart