The vulnerability exists in the WP Folio Team PPWP password‑protect‑page plugin, version 1.9.15 and earlier. An attacker can bypass the plugin’s authorization checks and gain access to pages that have been marked as protected. This broken access control flaw, identified as CWE‑862, allows unauthorized users to read sensitive content that should only be available to privileged members. The impact is limited to confidentiality of protected information rather than system compromise or execution of arbitrary code.

Affected systems include all WordPress sites that install the PPWP plugin from the WP Folio Team, specifically any instance running plugin version 1.9.15 or earlier. There is no specific operating system or WordPress core version requirement identified, so any site using the plugin within that range is potentially vulnerable.

The vulnerability carries a CVSS base score of 5.4, classifying it as moderate. No EPSS score is available, and the flaw has not been listed in the CISA KEV catalog. The exploit path is straightforward: an attacker can target the password‑protect‑page URL without prior authentication, exploit the missing authorization logic, and retrieve the protected page content. Because the flaw is web‑based, no advanced access or privileged user enumeration is required, making it readily exploitable in a typical WordPress deployment.