Security Alert Summary
The PPWP – Password Protect Pages plugin for WordPress contains a PHP Object Injection vulnerability via deserialization of untrusted input in the post_protection_roles parameter. Authenticated users with Contributor-level access or higher can supply crafted data that results in object injection. The vulnerability requires a PHP object POP chain to be present in another installed plugin or theme to achieve file deletion, data retrieval, or code execution.
CVE Details
- CVE ID: CVE-2026-0551
- Affected component: PPWP – Password Protect Pages plugin for WordPress
- Affected versions: All versions up to and including 1.9.18
- Published: August 23, 2026 at 12:16:49 AM
- Last modified: August 23, 2026 at 12:16:49 AM
- CVSS v3.1: Base score 8.8, severity HIGH
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low (authenticated user, Contributor-level or higher)
- User Interaction: None
- Scope: Unchanged
- Impact: Confidentiality: High, Integrity: High, Availability: High
- CWE / Weakness ID: CWE-502 (Deserialization of Untrusted Data)
Technical Details
This vulnerability is a PHP Object Injection resulting from deserialization of untrusted input supplied via the post_protection_roles parameter. When the plugin deserializes attacker-controlled data without proper validation or filtering, an attacker can inject crafted PHP objects into the application state.
The plugin itself does not contain a known POP (property-oriented programming) gadget chain. As a result, exploitation only leads to harmful actions if another installed plugin or theme provides a POP chain. If a compatible POP chain exists elsewhere on the site, an attacker may be able to delete arbitrary files, retrieve sensitive data, or execute code, depending on the capabilities of that POP chain. No specific functions or REST endpoints beyond the named parameter were identified in the provided data.
How This Could Impact Your Website
Consider a scenario where a site owner grants Contributor access to an external contractor to add content, and internal staff members also have Contributor or higher roles. An attacker who has obtained or been granted Contributor-level access could exploit the vulnerable post_protection_roles parameter to inject objects. If another plugin or theme on the site supplies a POP chain, the attacker could leverage that chain to read sensitive data or modify site files.
- Internal user email addresses and other sensitive data could be exposed if a POP chain allows data retrieval.
- Successful abuse of a POP chain could enable deletion of files or modification of content, increasing recovery and restoration effort.
- Exposed user information raises the risk of targeted phishing or social engineering against staff, contractors, or customers.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that still have write capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce the chance of POP chains being present.
- Monitor site activity and logs for unusual behavior, including unexpected file changes or data access patterns.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
