cve/2025/CVE-2025-5998.md

### [CVE-2025-5998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5998)
![](https://img.shields.io/static/v1?label=Product&message=PPWP%20%E2%80%93%20Password%20Protect%20Pages&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-280%20Improper%20Handling%20of%20Insufficient%20Permissions%20or%20Privileges&color=brightgreen)

### Description

The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.

### POC

#### Reference
- https://wpscan.com/vulnerability/17bad181-6cea-445e-b91c-22415d90743e/

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds