CVE-2026-14943

Executive Summary

CVE-2026-14943 is a high-severity unauthenticated information disclosure vulnerability in the "Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content" WordPress plugin, affecting all versions prior to 2.8.4. The flaw allows any unauthenticated remote attacker to bypass the sitewide password gate and retrieve protected content—including post bodies, page contents, and user account identifiers—by directly querying the WordPress REST API when a specific plugin option is enabled. This vulnerability is a regression of a previously patched issue (CVE-2024-0437, fixed in 2.6.7) that was reintroduced in version 2.6.8, leaving thousands of WordPress sites running legacy versions exposed. With a CVSS score of 7.5 (High) and public proof-of-concept research available, the risk of mass exploitation is elevated for sites still using outdated plugin versions.

Technical Analysis

The Password Protected plugin is designed to gate an entire WordPress site behind a single password prompt, protecting content from unauthenticated visitors. The plugin implements this by hooking into WordPress's template loading and initialization phases, and by attempting to block access to the REST API when the "protect REST API" option is enabled. However, a flaw in the plugin's access control logic in versions 2.6.8 through 2.8.3 allows REST API requests to bypass this gate entirely.

Vulnerability Mechanism:

The core issue resides in the plugin's REST API authentication hooks. When the sitewide password protection option is enabled, the plugin registers a callback on the rest_authentication_errors filter and the rest_pre_dispatch action to validate whether the current session has already authenticated with the sitewide password. In versions prior to 2.6.7, this check was performed correctly. The fix for CVE-2024-0437 introduced in 2.6.7 properly enforced the gate on all REST API endpoints.

However, in version 2.6.8, a code refactoring of the authentication check inadvertently wrapped the protection logic inside a conditional that only triggers when a specific (and non-default) option—the "allow REST API to bypass password" or similar—is disabled. This inversion of the conditional logic means that when the default configuration is used (where that option is enabled), the rest_authentication_errors hook returns null (signifying "no error"), permitting the request to proceed. Attackers can exploit this by sending direct HTTP requests to endpoints such as:

• /wp-json/wp/v2/posts
• /wp-json/wp/v2/pages
• /wp-json/wp/v2/users

The REST API will serialize the requested objects and return the full content, including the post/page body HTML and the user object's slug, name, and sometimes meta fields containing user IDs. Since the API response is JSON, it is trivially machine-parsable, allowing automated scraping of all protected content.

Attack Surface:

• Endpoint: WordPress REST API (any public route)
• Prerequisite: The site must have the "Password Protected" plugin active with sitewide protection enabled, which is the default configuration.
• Authenticated Requirement: None—this is a completely unauthenticated flaw.
• Complexity: Low—the exploit is a simple HTTP GET request with no special headers or payloads beyond a standard REST API path.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The confidentiality impact is high, as the entirety of password-protected content can be retrieved without credentials.

Exploitation Scenarios

The attack chain for CVE-2026-14943 is straightforward and requires no specialized tooling beyond curl or any HTTP client. Public proof-of-concept research confirming the bypass is available, though no full exploit code module has been published.

1. Reconnaissance / Target Identification

The attacker first identifies WordPress sites running the vulnerable plugin version. Techniques include:

• Using search engines like Shodan with dorks such as http.title:"Password Protected" or http.component:"WordPress" to find sites behind a password gate.
• Fingerprinting the plugin by requesting its readme file: GET /wp-content/plugins/password-protected/readme.txt. This file often contains version history and the current stable tag. An attacker can diff this against the known vulnerable range (>= 2.6.8, < 2.8.4).
• Checking the page source for enqueued plugin assets like /wp-content/plugins/password-protected/password-protected.css to confirm the plugin is active.

2. Trigger / Weaponization Steps

Once the attacker confirms the presence of a vulnerable version, they craft a simple GET request to a REST API endpoint containing sensitive data. Since the plugin fails to restrict API access, no bypass headers or authentication tokens are needed.

curl -s "https://target-site.com/wp-json/wp/v2/posts?per_page=100" | jq '.[].content.rendered'

This command retrieves the full rendered HTML of the latest 100 posts. To target pages or users, the requests are modified:

curl -s "https://target-site.com/wp-json/wp/v2/pages?per_page=100"
curl -s "https://target-site.com/wp-json/wp/v2/users?per_page=100"

3. Payload / Execution

Execution is the request itself; the "payload" is the URL query string. An attacker can automate this with scripts to enumerate all posts, pages, custom post types, and user accounts. For user enumeration, the response includes id, name, slug, and link fields, effectively leaking valid usernames for subsequent brute-force or phishing campaigns.

4. Post-Exploitation Impact

• Content Exfiltration: All gated content (e.g., premium posts, draft pages) is exposed, damaging the value proposition of the paywall or membership site.
• Account Enumeration: The leaked usernames can be fed into WordPress login brute-force attacks or used for targeted credential stuffing against the admin console, potentially leading to full site takeover if the admin uses a weak password.
• SEO/Data Integrity: Attackers may scrape and republish the protected content on other sites, impacting organic search rankings and copyright integrity.

Impact Assessment

Business Impact: For enterprises using this plugin to protect internal company portals, partner-only documentation, or paid subscriber content, the impact is severe. The confidentiality breach undermines the core functionality of the plugin. Even if the leaked content is not highly sensitive, the exposure of user identifiers (account names) provides a solid foothold for further social engineering or credential attacks against the WordPress admin interface.

Affected Systems: Any WordPress installation running the Password Protected plugin version 2.6.8 through 2.8.3 inclusive, with the sitewide password protection enabled (default setting).

Blast Radius: High. Given the plugin's historical popularity (over 200,000 active installs historically), the regression affects a potentially large number of live sites still on legacy version lines. Attack campaigns targeting these sites can harvest protected content at scale with minimal effort.

CVSS Breakdown (3.1 vector): The score of 7.5 reflects:

• Attack Vector: Network — Exploitable remotely via HTTP (AV:N).
• Attack Complexity: Low — No special conditions required (AC:L).
• Privileges Required: None — Unauthenticated access (PR:N).
• User Interaction: None — No user action needed (UI:N).
• Confidentiality Impact: High — complete exposure of protected data (C:H).
• Integrity Impact: None — No data modification (I:N).
• Availability Impact: None — no service disruption (A:N).

Detection Guidance

The following detection rules focus on identifying unauthenticated REST API requests that attempt to exfiltrate content or user data from protected WordPress sites.

Sigma Rule

title: CVE-2026-14943 - Unauthenticated REST API Data Exfiltration Attempt
id: 4f6c9d2e-1a3b-4c5d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects unauthenticated GET requests to WordPress REST API endpoints for posts, pages, and users from the same IP address, indicating a potential data scraping attempt exploiting CVE-2026-14943.
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    cs-method: GET
    cs-uri-stem|startswith:
      - '/wp-json/wp/v2/posts'
      - '/wp-json/wp/v2/pages'
      - '/wp-json/wp/v2/users'
  filter_authenticated:
    cs-uri-query|contains:
      - 'X-WP-Nonce'
      - '?nonce='
  filter_static:
    cs-uri-stem|contains: '_embed'
  condition: selection and not filter_authenticated and not filter_static
  timeframe: 10s
level: high
falsepositives:
  - Legitimate unauthenticated visitors viewing public REST API content if site allows it.
  - Development/testing tools that query the API without nonces.
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-14943

YARA Rule

rule wp_password_protected_rest_api_exploit
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects requests to WordPress REST API endpoints attempting to bypass Password Protected plugin access controls."
        date = "2026-01-01"
        reference = "CVE-2026-14943"
        score = 60
    strings:
        $api_posts = "/wp-json/wp/v2/posts" ascii wide nocase
        $api_pages = "/wp-json/wp/v2/pages" ascii wide nocase
        $api_users = "/wp-json/wp/v2/users" ascii wide nocase
        $rest_route = "rest_route" ascii wide nocase
        $bypass_pattern = "per_page=100" ascii wide nocase
    condition:
        filesize < 10KB and
        (1 of ($api_*)) and
        ( $rest_route or $bypass_pattern )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS WordPress Password Protected Plugin REST API Data Exfil Attempt (CVE-2026-14943)"; flow:to_server,established; content:"GET"; http_method; content:"/wp-json/wp/v2/"; http_uri; content:"posts|3f|"; http_uri; content:"per_page="; http_uri; threshold:type both, track by_src, count 20, seconds 10; classtype:attempted-user; sid:202614943; rev:1; reference:cve,2026-14943;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where event.category == "network" and network.protocol == "http" and
    http.request.method == "GET" and
    (url.path startsWith "/wp-json/wp/v2/posts" or
     url.path startsWith "/wp-json/wp/v2/pages" or
     url.path startsWith "/wp-json/wp/v2/users") and
    not user exists ]
  [ network where event.category == "network" and network.protocol == "http" and
    http.request.method == "GET" and
    (url.path startsWith "/wp-json/wp/v2/posts" or
     url.path startsWith "/wp-json/wp/v2/pages" or
     url.path startsWith "/wp-json/wp/v2/users") and
    not user exists ]

Splunk SPL Query

index=web sourcetype=access_combined
| spath input=uri path
| where match(path, "^/wp-json/wp/v2/(posts|pages|users)")
| stats count by src_ip, path
| where count > 20
| search NOT User-Agent="*Googlebot*" NOT User-Agent="*bingbot*"
| table _time, src_ip, uri, count
| sort - count

Wazuh OSSEC Rule

<group name="wordpress, access_control,">
  <rule id="100260" level="12">
    <decoded>web-accesslog</decoded>
    <match>GET /wp-json/wp/v2/(posts|pages|users)</match>
    <regex>per_page=</regex>
    <description>Potential CVE-2026-14943 exploitation attempt detected: unauthenticated REST API data scraping for Password Protected plugin.</description>
    <group>attack.initial_access,pci_dss_6.5,gdpr_article_32,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, NVD only; not yet independently confirmed on vendor site).

1. Immediate Mitigations (if patch cannot be applied immediately):

   • Disable the specific plugin option that permits REST API access (if available in the plugin settings). However, given the regression nature of the vulnerability, the safest immediate action is to deactivate and uninstall the plugin entirely until a confirmed patch is applied.
   • Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to /wp-json/wp/v2/{posts,pages,users} paths. This can be done at the edge before traffic reaches the WordPress application.
   • Restrict REST API access at the network level via .htaccess or Nginx configuration to deny public access to /wp-json/wp/v2, allowing only internal or authenticated traffic.

2. Patch / Upgrade Steps:

   • Upgrade the plugin to version 2.8.4 or later. This is the first version confirmed by NVD to contain the fix.
   • To upgrade: In the WordPress admin dashboard, navigate to Plugins → Installed Plugins, locate "Password Protected", and click "Update Now." If the automatic updater is not available, manually download the plugin zip from the WordPress plugin repository and replace the contents of the wp-content/plugins/password-protected/ directory via FTP or the plugin uploader.
   • After upgrading, verify the fix by logging out of WordPress and attempting to access a protected page via /wp-json/wp/v2/posts. The request should be rejected with a 401 Unauthorized error.

3. Long-Term Hardening:

   • Enable automated updates in WordPress or use a managed WordPress service that applies plugin updates automatically. This prevents regression-related vulnerabilities from persisting.
   • Audit your WordPress plugins for unmaintained dependencies or plugins with a history of regressions. Consider replacing this plugin with an equivalent that is actively maintained and has security disclosures.
   • Monitor logs for excessive REST API requests, especially from single IPs, as these may indicate automated scraping.
   • Implement a security plugin that adds authentication require to REST API endpoints (e.g., requiring an application password or a verification nonce for all REST requests).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-14943 — Official CVE record with CVSS score and description.
2. WordPress Plugin Directory: https://wordpress.org/plugins/password-protected/ — Plugin page with version history and download links for patched versions.
3. Original Vulnerability (CVE-2024-0437): https://nvd.nist.gov/vuln/detail/CVE-2024-0437 — The initial fix that was regressed; useful for understanding the root cause.
4. WPScan Advisory: https://wpscan.com/plugin/password-protected/ — Third-party vulnerability database entry (when updated) with technical write-ups.
5. CISA Known Exploited Vulnerabilities Catalog: Not currently listed; the CISA KEV feed does not contain this CVE, indicating no observed in-the-wild exploitation as of writing. However, the presence of public proof-of-concept research raises the likelihood of imminent exploit activity.

Threat Actor Campaigns: No specific threat actor campaigns have been publicly attributed to this CVE as of this report. However, given the ease of exploitation and the availability of public research, it is expected that opportunistic botnets and scraping services may adopt this technique shortly.