What’s Vulnerable › Vulnerabilities

CVE-2025-11244: Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-25 · updated 2026-10-08
• Weakness: CWE-285

Description

The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the "Use transients" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the "Use transients" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers.

Affected products

• saadiqbal Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content: through 2.7.11

References

• https://plugins.trac.wordpress.org/browser/password-protected/tags/2.7.11/includes/transient-functions.php#L33
• https://research.cleantalk.org/cve-2025-11244/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/30b4371d-54a2-4111-ad2c-b38b6b31884d?source=cve

Get alerted when CVE-2025-11244 or the next vulnerability affects your stack