The DocCheck Login plugin contains a flaw that allows unauthenticated users to access posts that should be protected, resulting in disclosure of confidential content. The weakness is driven by improper access control (CWE‑284) where the plugin redirects a user to a login form after the protected page has loaded, enabling attackers to view the page before authentication can be enforced.

The vulnerability affects WordPress installations that use the antwerpes DocCheck Login plugin versions 1.1.5 and earlier. Current releases of the plugin (from 1.1.6 onwards) contain the fix.

The CVSS score of 5.3 indicates moderate impact; the EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Attackers would need to request a password‑protected post from a site running the vulnerable plugin and, due to the redirect behavior, can view the post’s content before being prompted for credentials. The flaw is exploitable without any user interaction beyond accessing the URL.