The Password Protected plugin for WordPress, in versions prior to 2.8.4, does not enforce authentication on its REST API when the "Enable password protection" option is active. This allows any unauthenticated visitor to send REST requests and retrieve protected content such as pages, posts, categories, or partial content, as well as account identifiers. The flaw effectively bypasses the sitewide password gate, exposing sensitive information to the public. The weakness is a case of improper authorization (CWE‑284) leading to sensitive information disclosure (CWE‑200).

The vulnerability affects the Password Protected WordPress plugin across all WordPress installations using any version older than 2.8.4. Versions 2.6.7 and earlier fixed the issue, but 2.6.8 regressed it, so any site running 2.6.8 or earlier, except 2.6.7, is vulnerable. Administrators should examine the installed plugin version and upgrade if necessary.

Because the REST API is publicly reachable, an attacker does not need any credentials to exploit the flaw. The errant API endpoints return content that would normally be hidden behind the password protection. No explicit CVSS score is listed in the data, but the exposure of privileged content is a high‑severity risk. EPSS is not available, and the vulnerability is not currently listed in CISA KEV, yet the ease of exploitation warrants urgent attention.