The PPWP WordPress plugin up to version 1.9.19 contains an insecure direct object reference flaw that allows an attacker who can guess or know the identifier of a protected page to retrieve or manipulate that content without proper authorization, resulting in a breach of confidentiality and integrity of protected pages.

WordPress PPWP plugin (Password Protect Page) versions 1.9.19 and earlier, maintained by the WP Folio Team, are affected; any release from 1.9.20 onward is not vulnerable.

The CVSS v3 base score of 4.3 indicates moderate risk. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires knowledge of a protected page identifier and the ability to send crafted HTTP requests, so the attack vector involves any network-facing WordPress installation that has the vulnerable plugin installed.