PPWP Password Protect Pages
CVE-2026-0551 affects PPWP Password Protect Pages up to 1.9.18. Contributor-level users can inject a PHP object through post_protection_roles; real-world impact depends on whether another plugin or theme exposes a usable POP chain. Update to 1.9.19 or newer.
Wordfence Intelligence published CVE-2026-0551 on August 22, 2026 for PPWP – Password Protect Pages, a WordPress content-protection plugin with 30,000+ active installations. The vulnerability is a PHP Object Injection issue reachable by authenticated users with Contributor-level access or higher.
The vulnerable input is the post_protection_roles parameter. Wordfence notes that the vulnerable plugin itself does not include a known POP chain, so impact depends on the rest of the site. If another installed plugin or theme provides a usable gadget chain, object injection can escalate into file deletion, sensitive data exposure, or code execution depending on the available chain.
Vulnerability Summary
- Plugin: PPWP – Password Protect Pages
- Slug:
password-protect-page - CVE: CVE-2026-0551
- Severity: CVSS 8.8 high
- Attack class: PHP Object Injection / deserialization of untrusted data
- Required access: authenticated Contributor-level account or higher
- Affected versions: all versions up to and including 1.9.18
- Fixed version: 1.9.19; WordPress.org currently lists 1.9.22 as the latest release
Why The POP Chain Detail Matters
PHP Object Injection does not always produce immediate code execution by itself. The dangerous part is that deserialized objects can trigger magic methods such as __wakeup() or __destruct(). If another plugin, theme, or library on the same WordPress site includes a suitable POP chain, the injected object can become a practical exploit path.
For defenders, that means the correct response is still urgent patching. Do not downgrade the risk only because PPWP does not ship the known chain itself. WordPress sites are plugin stacks, and the exploitable chain can come from a different component.
Immediate Fix
- Update PPWP – Password Protect Pages to 1.9.19 or newer. The current WordPress.org release is 1.9.22.
- Remove unused Contributor, Author, Editor, and temporary staff accounts.
- Review recent content edits made by low-privilege users.
- Audit the plugin and theme stack for risky deserialization gadget surfaces, especially custom or abandoned code.
- If you cannot update immediately, temporarily deactivate PPWP or restrict Contributor+ editing access until the patch is deployed.
WP-CLI Verification
wp plugin get password-protect-page --fields=name,version,status
wp plugin update password-protect-page
wp plugin get password-protect-page --field=versionList low-privilege users who can create or edit content. Focus review on accounts that do not need publishing workflow access.
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
wp user list --role=author --fields=ID,user_login,user_email,user_registered
wp post list --post_type=any --post_status=any --fields=ID,post_type,post_status,post_author,post_modified --orderby=modified --order=DESC --posts_per_page=25POP Chain Triage
This is a defensive triage check, not an exploit test. It helps identify installed code that should receive extra review when an object injection vulnerability is present.
# Run from the WordPress root on a controlled admin shell.
# Review matches manually; a magic method is not automatically exploitable.
grep -RE 'function __(wakeup|destruct|unserialize)' wp-content/plugins wp-content/themesTemporary Mitigation
The safe fix is the plugin update. If patching is delayed, reduce the attack surface by removing Contributor-level access from untrusted users and preventing low-privilege accounts from editing password-protected content. On high-risk sites, deactivate PPWP until the patched version can be installed and tested.
# Temporary containment only; use the update as the permanent fix.
wp plugin deactivate password-protect-pageSources
