The PPWP – Password Protect WordPress plugin allows authenticated users with Contributor role or higher to edit the password of any password‑protected post through the ppw_free_set_password AJAX action. Because the plugin does not validate user permissions on this action, an attacker who can log into the WordPress site as a Contributor can set any post’s password to a value they choose and then log in with that password to read the protected content. The vulnerability is an authorization bypass through a user‑controlled key, identified as CWE‑639. As a result, an attacker can gain unauthorized access to protected posts without needing administrative privileges.

All installations of the PPWP – Password Protect Pages plugin with a version number 1.9.20 or earlier are vulnerable. The affected vendor is Buildwps, and the plugin is widely used as the leading password protection solution for WordPress sites.

The vulnerability carries a CVSS score of 4.3, indicating a low to medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting limited exploitation activity to date. However, the attack requires only a Contributor‑level login, which is a common role on many sites. Once bypassed, the attacker can force any password‑protected post to a known or guessed password, thereby achieving unauthorized content access. Because the bug arises from missing validation rather than an accidental data leak, remediation is straightforward and should be applied promptly to prevent potential abuse.