Overview
A high-severity PHP Object Injection vulnerability (CVSS 8.8) has been discovered in the PPWP – Password Protect Pages plugin for WordPress, affecting all versions up to and including 1.9.18. The vulnerability stems from unsafe deserialization of user-supplied input via the post_protection_roles parameter, allowing authenticated attackers with at minimum Contributor-level access to inject arbitrary PHP objects.
Depending on the presence of a suitable Property-Oriented Programming (POP) chain in the target environment, this can lead to arbitrary file deletion, server-side request forgery (SSRF), or full remote code execution (RCE).
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-0551 |
| CVSS Score | 8.8 (High) |
| Affected Plugin | PPWP – Password Protect Pages |
| Affected Versions | ≤ 1.9.18 |
| Vulnerable Parameter | post_protection_roles |
| Vulnerability Type | PHP Object Injection via Deserialization (CWE-502) |
| Attack Vector | Network |
| Authentication Required | Yes — Contributor or higher |
| Published | 2026-08-23 |
How the Vulnerability Works
The PPWP plugin allows WordPress users to password-protect individual pages and posts, with optional role-based access control. The role configuration data is stored and retrieved using PHP's native serialize() / unserialize() functions on the post_protection_roles parameter.
When a Contributor-level user submits a crafted post update containing a maliciously serialized PHP object in the post_protection_roles field, WordPress passes this data directly to unserialize() without sanitization. PHP's unserialize() function instantiates objects from the serialized string and calls any __wakeup() or __destruct() magic methods present in those objects.
If the WordPress installation (including its themes and plugins) contains a POP chain — a sequence of classes whose magic methods can be chained together to perform dangerous operations — the attacker can achieve:
- Arbitrary file deletion (common PHP POP chain outcome)
- Arbitrary file write (if a suitable chain exists)
- Remote Code Execution (via file write or other chain mechanisms)
- SSRF (via object deserialization triggering HTTP requests)
Attack Requirements
- WordPress site running PPWP – Password Protect Pages version ≤ 1.9.18
- Attacker must have at least Contributor role on the target site
- Contributor access can often be obtained via open registrations, social engineering, or compromised credentials
- A usable POP chain must exist in the installed codebase (common in environments with many plugins/themes)
Affected Systems
All WordPress installations running PPWP – Password Protect Pages version 1.9.18 or earlier are vulnerable. The plugin has been installed on over 100,000 WordPress sites based on its active install count in the WordPress plugin directory.
Impact Assessment
A successful exploit allows an attacker to:
- Execute arbitrary PHP code on the server, achieving full server compromise
- Delete critical WordPress files, causing site outages or enabling further exploitation
- Access the WordPress database including all user credentials, posts, and sensitive configuration
- Establish backdoors for persistent access
- Move laterally to other applications hosted on the same server
Recommended Mitigations
- Update immediately — upgrade PPWP – Password Protect Pages to a patched version as soon as one is released; monitor the plugin's WordPress.org page for updates
- Restrict Contributor access — review who holds Contributor roles on your site; remove or demote untrusted users
- Disable untrusted user registration — if your site allows open registration and assigns Contributor roles, disable this immediately
- Deploy a Web Application Firewall (WAF) — rules blocking serialized PHP objects in POST parameters can mitigate this class of vulnerability
- Audit installed plugins and themes for known POP chain gadgets — fewer dependencies reduce the exploitability of deserialization vulnerabilities
- Monitor for suspicious activity — watch for unexpected file modifications, new admin accounts, or unusual outbound connections
Deserialization Vulnerability Context
PHP Object Injection is a well-understood and consistently exploited vulnerability class. The WordPress ecosystem is particularly susceptible because the large number of plugins and themes installed on a typical site creates a rich pool of POP chain gadgets. WordPress itself and several popular plugins (WooCommerce, Yoost SEO, etc.) have been leveraged as gadget sources in past campaigns.
Site owners should treat any plugin using unserialize() on user-supplied input as a critical security risk.