What’s Vulnerable › Vulnerabilities
CVE-2026-90952: WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-02 · updated 2026-10-02
- Weakness: CWE-862
Description
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.
Affected products
- Wp Edit Password Protected: from 2.0.0 before 2.0.7 — fixed in 2.0.7
How to fix
Upgrade to a fixed version: Wp Edit Password Protected 2.0.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-90952 or the next vulnerability affects your stack