The WP Edit Password Protected WordPress plugin before version 2.0.7 fails to enforce its site‑wide privacy setting for the REST API, allowing anyone to reach the JSON endpoints and retrieve post and page data that should be hidden. This results in accidental disclosure of content that the site administrator intended to keep private, potentially leaking sensitive material.

Systems running the WP Edit Password Protected plugin version 2.0.0 through 2.0.6 on any WordPress installation are affected. The vulnerability applies to all sites where the plugin's access mode is set to hide content from public view, regardless of additional plugins or themes.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of 0.00235 indicates a very low probability of exploitation, and the vulnerability is not listed in the KEV catalog, so widespread exploitation is unlikely but could rise if the plugin remains unpatched. Based on the description, the likely attack vector involves unauthenticated GET requests to the WordPress REST API, such as /wp-json/wp/v2/posts, which are inferred to be the endpoints used for content retrieval. Attackers can exploit the flaw by sending these unauthenticated requests, obtaining the complete content from areas intended to be protected. The risk is therefore disclosure of private content and potential exposure of sensitive information.