CVE-2026-14943: CWE-200 Information Exposure in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content
The Password Protected WordPress plugin before version 2.8.4 has a vulnerability that allows unauthenticated users to bypass the sitewide password protection via the REST API when a specific option is enabled. This issue re-introduces a previously fixed flaw that was patched in version 2.6.7 but regressed in 2.6.8. The vulnerability permits unauthorized reading of protected content and account identifiers.
AI Analysis
Technical Summary
CVE-2026-14943 is an information exposure vulnerability (CWE-200) in the Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin. Versions at exactly 2.6.8 are affected due to a regression that removed REST API access restrictions for unauthenticated users when a certain option is enabled. This allows bypassing the password protection and accessing protected content and account identifiers via the REST API. The issue was previously fixed in version 2.6.7 but reintroduced in 2.6.8. No patch or official remediation level is currently indicated.
Potential Impact
Unauthenticated attackers can bypass the password protection on the site and access otherwise protected content and account identifiers through the REST API. This leads to a confidentiality breach of sensitive site content. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling the specific option that allows REST API access without authentication or downgrade to version 2.6.7 where the issue was fixed. Monitor vendor channels for updates.
CVE-2026-14943: CWE-200 Information Exposure in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content
Description
The Password Protected WordPress plugin before version 2.8.4 has a vulnerability that allows unauthenticated users to bypass the sitewide password protection via the REST API when a specific option is enabled. This issue re-introduces a previously fixed flaw that was patched in version 2.6.7 but regressed in 2.6.8. The vulnerability permits unauthorized reading of protected content and account identifiers.
CVSS v3.1
Score 7.5high
Affected software
Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14943 is an information exposure vulnerability (CWE-200) in the Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin. Versions at exactly 2.6.8 are affected due to a regression that removed REST API access restrictions for unauthenticated users when a certain option is enabled. This allows bypassing the password protection and accessing protected content and account identifiers via the REST API. The issue was previously fixed in version 2.6.7 but reintroduced in 2.6.8. No patch or official remediation level is currently indicated.
Potential Impact
Unauthenticated attackers can bypass the password protection on the site and access otherwise protected content and account identifiers through the REST API. This leads to a confidentiality breach of sensitive site content. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling the specific option that allows REST API access without authentication or downgrade to version 2.6.7 where the issue was fixed. Monitor vendor channels for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-07T12:05:19.128Z
- State
- PUBLISHED
Threat ID: 6a75772fbf8831d539df5e4c
Added to database: 08/07/2026, 06:11:59 UTC
Last enriched: 08/14/2026, 15:58:43 UTC
Last updated: 09/21/2026, 22:01:32 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.