CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API
Unauthenticated attackers can bypass password protection to read protected content and account identifiers via the REST API when a specific option is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14943?
CVE-2026-14943 is a high-severity vulnerability in Unknown Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.
Weakness: CWE-200
Which versions are affected by CVE-2026-14943?
How do I fix CVE-2026-14943?
No fix has been published for CVE-2026-14943 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-14943 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14943 exists.
Sources
Also known as GHSA-qmm8-q2c2-c4m3.