CVE-2026-14943
Received Received - Intake

Password Bypass in Password Protected WordPress Plugin

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: WPScan

Description
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-14943
EUVD
EUVD-2026-54377

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
password_protected password_protected to 2.8.4 (exc)
password_protected password_protected 2.6.7
password_protected password_protected 2.6.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Password Protected WordPress plugin versions before 2.8.4. When a specific option is enabled, unauthenticated users can bypass sitewide password protection and access protected content and account identifiers through the REST API. It is a regression of a previously fixed issue (CVE-2024-0437).

Detection Guidance

Check the installed version of the Password Protected plugin. If it is below 2.8.4, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Impact Analysis

Unauthenticated users could read sensitive content and account details that should be restricted. This may lead to unauthorized access to private data, compromising confidentiality and potentially enabling further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Password Protected plugin to version 2.8.4 or later immediately. Disable the plugin temporarily if an update is not possible, but note this will remove password protection functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14943. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart