CVE-2026-90952 — WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

CVE-2026-90952

WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API PUBLISHED

Description (CNA)

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Edit Password Protected	affected 2.0.0 before 2.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8cc260a9-f335-4d8c-a1e0-f942f0963bcf/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.