The Password Protected Store for WooCommerce plugin suffers from an improper access control vulnerability (CWE-284) that leads to sensitive information exposure through its REST API. Specifically, unauthenticated users can retrieve post titles and content, which should be protected by the plugin's password mechanism. This affects all versions up to 2.2. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, resulting in confidentiality impact only.

An attacker without authentication can extract sensitive data such as post titles and content from the affected plugin via the REST API. This exposure could lead to information disclosure but does not affect integrity or availability. The impact is limited to confidentiality loss of potentially sensitive store content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling the REST API endpoints related to the plugin or restricting access to trusted users as a temporary mitigation.