CVE-2025-8945CWE-863broken-access-control

CVE-2025-8945

Medium · published September 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-02T19:17Z
References (1)
https://wpscan.com/vulnerability/37cec6e0-a349-4cc7-971d-b370bc733ab6/ · [email protected]
EPSS history
Timeline
  • 04 SEP 03:38Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:25Z
    Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API
    cvelistv5