CVE-2026-90952

WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

Affected

WP Edit Password Protected

CVSS v3.1 WPSCAN

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.24% chance of exploitation in the next 30 days, 13th percentile

Published

2026-10-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8cc260a9-f335-4d8c-a1e0-f942f0963bcf/

References

• CVE Record
• NVD entry