Security Alert Summary
The Password Protected – Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin contains a vulnerability that can allow unauthenticated visitors to bypass a sitewide password gate and read content and account identifiers exposed via the REST API when a specific plugin option is enabled. This reproduces a previously fixed issue that regressed in a subsequent release.
CVE Details
- CVE ID: CVE-2026-14943
- Affected product: Password Protected – Lock Entire Site, Pages, Posts, Categories, and Partial Content (WordPress plugin)
- Affected versions: 2.6.8 up to (but not including) 2.8.4 (as reported)
- Published: August 7, 2026 at 6:16:54 AM
- Last modified: August 7, 2026 at 6:16:54 AM
- CVSS v3.1 base score / severity / vector: Not provided in the source data
- Authentication requirements: None – the plugin fails to restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated access (per the vendor description)
- Privileges required: None (unauthenticated access possible)
- User interaction: Not specified; vulnerability is exploitable via unauthenticated REST API access when the option is enabled
- Primary impact:
- Confidentiality: Exposure of otherwise-protected content and account identifiers via the REST API
- Integrity: Not indicated by the provided data
- Availability: Not indicated by the provided data
- CWE / weakness ID: Not provided in the source data
Technical Details
According to the advisory, the plugin does not restrict REST API access to authenticated users when a particular option is enabled. This allows unauthenticated visitors to bypass the sitewide password gate and access protected content and account identifiers via the REST API endpoints. The issue is a regression: a similar vulnerability (CVE-2024-0437) was previously patched in version 2.6.7 and was re-introduced in 2.6.8.
No specific REST API endpoints or internal function names were provided in the source data. The root cause described is a missing or insufficient access restriction on REST API responses when the plugin option is active, resulting in disclosure of content and account identifiers that should have been protected by the password gate.
How This Could Impact Your Website
Consider a small team running a members-only WordPress site: the site owner configures a sitewide password, editors and contributors publish protected content, and an external contractor helps with content updates. If the plugin option that disables REST API restrictions is enabled on an affected version, unauthenticated visitors could retrieve content and account identifiers through the REST API that would otherwise be blocked by the password gate. This could lead to exposure of internal user email addresses and usernames and increase the risk of targeted phishing or social engineering against staff and contributors.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and REST API access logs for unusual behavior or unexpected public access to protected content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
