CVE-2025-3453: WordPress Password Protected Plugin Flaw

CVE-2025-3453 Overview

CVE-2025-3453 affects the Password Protected plugin for WordPress, a widely deployed plugin used to restrict access to WordPress sites, pages, and WooCommerce products. The vulnerability exists in the password_protected_cookie function across all versions up to and including 2.7.7. Unauthenticated attackers can extract sensitive data, including all protected site content, when the Use Transient setting is enabled. The flaw is classified under [CWE-863] as an incorrect authorization issue. The plugin developer resolved the issue in changeset #3274358.

Critical Impact
Unauthenticated network attackers can retrieve the contents of password-protected WordPress pages, posts, and WooCommerce products when the Use Transient option is enabled, bypassing the plugin's access controls.

Affected Products

Password Protected plugin for WordPress versions up to and including 2.7.7
WordPress sites using the plugin with the Use Transient setting enabled
WooCommerce stores relying on the plugin to restrict product or category access

Discovery Timeline

2025-04-17 - CVE-2025-3453 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3453

Vulnerability Analysis

The Password Protected plugin gates access to WordPress content behind a shared password. When a visitor authenticates, the plugin issues a cookie and, if configured, stores validation data in a WordPress transient. The password_protected_cookie function processes this cookie value during subsequent requests to determine whether a session is valid. The vulnerability allows unauthenticated requests to reach the protected content by manipulating or supplying values processed by this function, provided the Use Transient feature is active. This results in disclosure of all protected posts, pages, and WooCommerce items that the plugin is meant to gate.

Root Cause

The root cause is an authorization logic flaw ([CWE-863]) within the transient-backed cookie validation path. The password_protected_cookie function does not adequately verify that the presented cookie corresponds to a legitimate, authenticated session before granting access to protected content. When the transient storage option is enabled, the validation path trusts data that an unauthenticated client can influence, effectively bypassing the password gate.

Attack Vector

Exploitation occurs remotely over the network with no authentication or user interaction required. An attacker sends crafted HTTP requests to a vulnerable WordPress site that has the Password Protected plugin installed with the Use Transient setting enabled. The plugin's flawed cookie handling logic returns the protected content in the response. No specialized tooling is required; standard HTTP clients are sufficient. See the Wordfence Vulnerability Report and the WordPress Plugin Compatibility Code for implementation context.

Detection Methods for CVE-2025-3453

Indicators of Compromise

Unauthenticated HTTP GET requests to password-protected URLs that return HTTP 200 responses containing gated content
Anomalous request patterns targeting endpoints managed by the Password Protected plugin without a preceding password submission POST
Repeated cookie-bearing requests from a single IP enumerating protected pages, posts, or WooCommerce product URLs

Detection Strategies

Inspect web server access logs for requests to protected resources that succeed without a corresponding password form submission
Compare the referrer chain and session cookie issuance events to identify sessions that access protected content without prior authentication
Deploy web application firewall rules that flag requests carrying password_protected_auth cookies with malformed or reused values

Monitoring Recommendations

Monitor the WordPress wp_options table and transient storage for anomalous read patterns tied to the Password Protected plugin
Alert on spikes in traffic to URLs known to be gated by the plugin, particularly from unauthenticated sources
Track plugin version inventory across all managed WordPress sites and flag any instance running version 2.7.7 or earlier

How to Mitigate CVE-2025-3453

Immediate Actions Required

Update the Password Protected plugin to the version released in WordPress Changeset #3274358 or later
Disable the Use Transient setting in the plugin configuration until the update is applied
Audit protected content access logs for signs of unauthorized retrieval prior to patching

Patch Information

The plugin author addressed the issue in changeset #3274358. Site administrators should upgrade to a version later than 2.7.7. Verify the installed version through the WordPress admin dashboard under Plugins, or by inspecting the plugin header in wp-content/plugins/password-protected/password-protected.php.

Workarounds

Disable the Use Transient option within the Password Protected plugin settings to remove the vulnerable code path
Deactivate the Password Protected plugin entirely and rely on native WordPress post password protection until patching is complete
Restrict access to sensitive pages using server-level authentication such as HTTP Basic Auth or IP allowlists at the reverse proxy

bash

# Verify installed plugin version via WP-CLI
wp plugin get password-protected --field=version

# Update the plugin to the patched release
wp plugin update password-protected

# Confirm update succeeded
wp plugin list --name=password-protected --fields=name,status,version