CVE-2026-0551: CWE-502 Deserialization of Untrusted Data in buildwps PPWP – Password Protect Pages

CVE-2026-0551 is a deserialization vulnerability (CWE-502) in the buildwps PPWP – Password Protect Pages WordPress plugin affecting all versions up to 1.9.18. The flaw allows authenticated users with Contributor or higher privileges to inject PHP objects via the 'post_protection_roles' parameter. However, the plugin itself does not contain a POP chain necessary for exploitation. Successful exploitation requires an additional plugin or theme installed on the site that contains a POP chain, enabling actions such as arbitrary file deletion, sensitive data retrieval, or code execution depending on the POP chain capabilities.

If exploited in an environment where a suitable POP chain exists in other installed components, this vulnerability can lead to high-impact consequences including arbitrary code execution, data disclosure, and file deletion. Without a POP chain, the vulnerability cannot be exploited to cause harm. The CVSS v3.1 score is 8.8 (high severity), reflecting the potential impact when combined with other vulnerable components.

No official patch or remediation level is currently provided by the vendor. Users should verify if updates or patches become available from buildwps. Until then, restrict Contributor-level access to trusted users only and review installed plugins and themes for known POP chains that could enable exploitation. Monitor vendor advisories for updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.