CVE-2025-3453

Description

The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.

PUBLISHED Reserved 2025-04-08 | Published 2025-04-17 | Updated 2026-04-08 | Assigner Wordfence

Problem types

CWE-863 Incorrect Authorization

Product status

Timeline

Credits

Brian Sans-Souci finder

Audrey François finder

References

www.wordfence.com/...-55e3-461a-9844-52e69904da1b?source=cve

plugins.trac.wordpress.org/...unk/includes/compatibility.php

plugins.trac.wordpress.org/changeset/3274358/

cve.org (CVE-2025-3453)

nvd.nist.gov (CVE-2025-3453)

Download JSON