CyberRota Analysis
AI-GeneratedThe Password Protected plugin for WordPress versions prior to 2.8.4 is vulnerable due to improper REST API access controls, allowing unauthenticated users to bypass password protection and access restricted content and account identifiers. This vulnerability reintroduces a previously resolved issue, posing a significant risk to site confidentiality. WordPress site administrators using this plugin should prioritize updating to version 2.8.4 or later to mitigate potential data exposure.
Original NVD Description
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.