PPWP

PPWP through 1.9.21 lets a Contributor or higher store script-capable values in attributes of the ppwp shortcode. Insufficient sanitization and output escaping cause the payload to execute when a visitor opens the affected page.

PPWP through 1.9.18 deserializes untrusted data from the post_protection_roles parameter. A Contributor or higher can inject a PHP object; PPWP does not itself contain a known POP chain, so further impact requires another installed plugin or theme with a usable chain. Depending on that chain, exploitation could disclose data, delete files or execute code.

PPWP through 1.9.15 applies an improper capability check in can_access(). A Contributor can retrieve a master password and use it to open any content protected by the plugin.

PPWP – Password Protect Pages through 1.9.20 exposes the ppw_free_set_password AJAX action without verifying that the authenticated Contributor can manage the attacker-selected password-protected post. A Contributor can change the password on another protected post and then use the new password to access its content.

PPWP – Password Protect Pages through 1.9.21 lets a Contributor or higher store script-capable values in the placeholder or button attributes of a ppwp shortcode. PPW_Service_Shortcode::get_restricted_content_form() passed those values through general HTML sanitization but inserted them into the password form's placeholder and submit-button value attributes without attribute-context escaping. The payload therefore executes when a visitor opens the affected page. Version 1.9.22 applies esc_attr() to both values.

PPWP is affected by broken access control. Exploitation requires an authenticated contributor account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 1.9.19.

PPWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through <= 1.9.15.