The Password Protected plugin for WordPress is vulnerable through its password_protected_cookie function. Unauthenticated users can invoke this function to extract all protected site content when the 'Use Transient' option is enabled. The flaw allows an attacker to obtain sensitive information that should remain restricted, effectively bypassing the plugin’s content‑level protection. The weakness is categorized as CWE‑863, reflecting an insufficiently limited functionality exposed to unauthorized users.

The issue affects installations of the Password Protected plugin – Lock Entire Site, Pages, Posts, Categories, and Partial Content – by the vendor Saadiqbal. All released versions up to and including version 2.7.7 are vulnerable. The plugin is a WordPress plugin that restricts access to site content, pages, and WooCommerce products; users who rely on it for site protection are impacted.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation of this flaw is currently unlikely, and it is not listed in the CISA KEV catalog. The known attack surface is a remote, unauthenticated web request to the plugin when the 'Use Transient' setting is active. An attacker would need network access to the WordPress site, but no authentication or prior setup is required, making the vulnerability potentially exploitable in production environments that rely on this plugin for access control.