CVE-2025-5998: Passwordprotectwp Password Protect WordPress

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.

Affected products

• Passwordprotectwp Password Protect WordPress: before 1.9.11 (fixed in 1.9.11)

Published 2025-08-14. Last modified 2026-06-17.