The WordPress Password Protected plugin can be misused when the "Use transients" feature is enabled. The plugin trusts client‑controlled HTTP headers such as X-Forwarded-For and HTTP_CLIENT_IP to determine a visitor’s IP address. By sending a forged header that contains the IP address of a legitimately authenticated user, an attacker can bypass the plugin’s authorization checks and gain access to otherwise restricted content. This vulnerability results in an authorization bypass (CWE-285) but does not lead to remote code execution or other higher‑level impact.

WordPress sites running the Password Protected plugin on version 2.7.11 or earlier, with the "Use transients" option enabled and not protected by a CDN or reverse proxy that overrides client headers. The plugin is commonly used to lock entire sites, pages, posts, categories, and partial content.

The CVSS score of 3.7 indicates low overall severity, and the EPSS score of less than 1 % suggests that widespread exploitation is currently unlikely. Because the problem requires a specific configuration (transients enabled and open HTTP headers), the attack vector is network‑based header spoofing, but the exploitability is limited by the need for the attacker to control request headers. The vulnerability is not listed in CISA’s KEV catalog.