CVE-2026-90952: Unknown Wp Edit Password Protected

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

Affected products

• Unknown Wp Edit Password Protected: from 2.0.0, before 2.0.7 (fixed in 2.0.7)

Published 2026-10-02. Last modified 2026-10-02.