CVE-2026-0551 describes a deserialization of untrusted data vulnerability (CWE-502) in the buildwps PPWP – Password Protect Pages WordPress plugin. The vulnerability exists in all versions up to 1.9.18 and allows authenticated users with Contributor-level access or above to inject PHP objects via the 'post_protection_roles' parameter. However, the plugin itself does not contain a PHP Object Injection POP chain, so exploitation depends on the presence of additional plugins or themes that provide such a chain. If a POP chain is present, attackers could leverage this to perform critical actions including arbitrary file deletion, data disclosure, or remote code execution. The CVSS 3.1 score is 8.8 (high severity) with network attack vector, low attack complexity, and no user interaction required.

The vulnerability allows authenticated attackers with Contributor-level or higher privileges to inject PHP objects via deserialization. Without a POP chain in the vulnerable plugin, there is no direct impact. However, if other plugins or themes installed on the site contain a POP chain, attackers may escalate the impact to include arbitrary file deletion, sensitive data exposure, or remote code execution. This elevates the risk to confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for updates from the vendor buildwps regarding patches or mitigations. Review installed plugins and themes for known POP chains that could be exploited in conjunction with this vulnerability.