PT-2025-43704 · WordPress · Password Protect

Dmitry Ignatyev · Published 2025-10-25 · Updated 2025-10-25 · CVE-2025-11244

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Password Protected plugin for WordPress versions prior to 2.7.12

Description The Password Protected plugin for WordPress is susceptible to authorization bypass through IP address spoofing. This occurs because the plugin relies on client-controlled HTTP headers—specifically, X-Forwarded-For and HTTP CLIENT IP—to determine user IP addresses within the pp get ip address() function when the "Use transients" feature is enabled. An attacker can bypass authorization by manipulating these headers to impersonate a legitimately authenticated user, provided the "Use transients" option is enabled and the site is not behind a Content Delivery Network (CDN) or reverse proxy that overwrites these headers.

Recommendations Update the Password Protected plugin to version 2.7.12 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-11244

Affected Products

Password Protect

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11244 · Security Note
• https://twitter.com/VulmonFeeds/status/1981999037738778658 · Twitter Post
• https://t.me/CVEtracker/35725 · Telegram Post
• https://research.cleantalk.org/cve-2025-11244 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/30b4371d-54a2-4111-ad2c-b38b6b31884d?source=cve · Note
• https://twitter.com/CVEnew/status/1981959756114727085 · Twitter Post
• https://t.me/cveNotify/140333 · Telegram Post
• https://plugins.trac.wordpress.org/browser/password-protected/tags/2.7.11/includes/transient-functions.php#L33 · Note