PT-2025-43704

Name of the Vulnerable Software and Affected Versions Password Protected plugin for WordPress versions prior to 2.7.12 Description The Password Protected plugin for WordPress is susceptible to authorization bypass through IP address spoofing. This occurs because the plugin relies on...

CVE-2025-11244: Improper Authorization

The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers such as X-Forwarded-For, HTTPCLIENTIP, and similar headers to determine user IP...