The PPWP – Password Protect Pages WordPress plugin contains a PHP Object Injection flaw through the post_protection_roles parameter. The vulnerability allows an authenticated user with Contributor level or higher to inject arbitrary objects during the deserialization process. The plugin itself does not supply a PHP object that could lead to immediate code execution, but if another plugin or theme on the site provides a PHP object that performs a malicious action, an attacker could delete files, retrieve sensitive data, or execute code. The impact is therefore conditional on the presence of a POP chain on the system. The described flaw is rated a CVSS of 8.8, indicating high severity.

WordPress sites that have the PPWP – Password Protect Pages plugin installed at version 1.9.18 or earlier are affected. No specific WordPress or operating system requirements are mentioned, so the vulnerability applies across all supported WordPress platforms that use this plugin.

Because the flaw requires authenticated access at Contributor level or higher, it is not publicly exploitable, but it can be leveraged by legitimate users with elevated privileges. The lack of an embedded PHP object in the plugin means that exploitation depends on another plugin or theme providing a usable POP chain. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation is currently unlikely. However, the potential for full remote code execution remains if a suitable malicious object is present, making the risk high for sites that use additional plugins or themes prone to similar vulnerabilities.