The PPWP – Password Protect Pages plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to and including 1.8.9. An unauthenticated attacker can exploit the plugin's API to retrieve metadata like post titles, IDs, and slugs, even for posts protected by passwords. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting its medium severity and network attack vector with no privileges or user interaction required. No known exploits are reported in the wild, and no official patch or vendor advisory is currently available.

An attacker can obtain sensitive metadata about posts, including those that are password-protected, potentially aiding further reconnaissance or targeted attacks. There is no impact on integrity or availability, and the exposure is limited to information disclosure only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the API endpoints used by the plugin or disabling the plugin if feasible to prevent unauthorized information disclosure.