CVE-2025-11244

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11244", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-02T14:25:50.992Z", "datePublished": "2025-10-25T05:31:20.356Z", "dateUpdated": "2026-04-08T16:44:55.005Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:55.005Z"}, "affected": [{"vendor": "saadiqbal", "product": "Password Protected \u2014 Lock Entire Site, Pages, Posts, Categories, and Partial Content", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the \"Use transients\" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the \"Use transients\" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers."}], "title": "Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30b4371d-54a2-4111-ad2c-b38b6b31884d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/password-protected/tags/2.7.11/includes/transient-functions.php#L33"}, {"url": "https://research.cleantalk.org/cve-2025-11244/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-285 Improper Authorization", "cweId": "CWE-285", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "baseSeverity": "LOW"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-09-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-06T15:48:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-24T16:54:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T15:49:48.047267Z", "id": "CVE-2025-11244", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:49:58.830Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11244", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:49:48.047267Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:49:53.143Z"}}], "cna": {"title": "Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "saadiqbal", "product": "Password Protected \u2014 Lock Entire Site, Pages, Posts, Categories, and Partial Content", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.11"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-17T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-06T15:48:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-24T16:54:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30b4371d-54a2-4111-ad2c-b38b6b31884d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/password-protected/tags/2.7.11/includes/transient-functions.php#L33"}, {"url": "https://research.cleantalk.org/cve-2025-11244/"}], "descriptions": [{"lang": "en", "value": "The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the \"Use transients\" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the \"Use transients\" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:55.005Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11244", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:44:55.005Z", "dateReserved": "2025-10-02T14:25:50.992Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-25T05:31:20.356Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Password Protected \u2014 Lock Entire Site, Pages, Posts, Categories, and Partial Content", "vendor": "saadiqbal", "versions": [{"lessThanOrEqual": "2.7.11", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the \"Use transients\" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the \"Use transients\" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers."}, {"lang": "es", "value": "El plugin Password Protected para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n mediante suplantaci\u00f3n de direcci\u00f3n IP en todas las versiones hasta la 2.7.11, inclusive. Esto se debe a que el plugin conf\u00eda en encabezados HTTP controlados por el cliente (como X-Forwarded-For, HTTP_CLIENT_IP y encabezados similares) para determinar las direcciones IP de los usuarios en la funci\u00f3n 'pp_get_ip_address()' cuando la funci\u00f3n \u201cUsar transitorios\u201d est\u00e1 habilitada. Esto hace posible que los atacantes omitan la autorizaci\u00f3n suplantando estos encabezados con la direcci\u00f3n IP de un usuario leg\u00edtimamente autenticado, siempre que la opci\u00f3n \u201cUsar transitorios\u201d est\u00e9 habilitada (configuraci\u00f3n no predeterminada) y el sitio no est\u00e9 detr\u00e1s de una CDN o un proxy inverso que sobrescriba estos encabezados."}], "id": "CVE-2025-11244", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11244", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T15:49:48.047267Z", "version": "2.0.3"}}]}, "published": "2025-10-25T06:15:34.910", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/password-protected/tags/2.7.11/includes/transient-functions.php#L33"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-11244/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30b4371d-54a2-4111-ad2c-b38b6b31884d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:52:00.177312+00:00", "value": {"mitigation_remediation": ["Disable the \"Use transients\" feature in the Password Protected plugin settings to prevent the plugin from trusting client-supplied headers.", "Configure your web server or reverse proxy to strip or overwrite X-Forwarded-For, HTTP_CLIENT_IP, and similar headers, ensuring the actual visitor\u2019s IP is used.", "Upgrade the WordPress core and the Password Protected plugin to a version newer than 2.7.11, or remove the plugin if no update is available."], "summary": {"action": "Disable transients", "impact": "Unauthorized access"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Password Protected plugin on version 2.7.11 or earlier, with the \"Use transients\" option enabled and not protected by a CDN or reverse proxy that overrides client headers. The plugin is commonly used to lock entire sites, pages, posts, categories, and partial content.", "description_and_impact": "The WordPress Password Protected plugin can be misused when the \"Use transients\" feature is enabled. The plugin trusts client\u2011controlled HTTP headers such as X-Forwarded-For and HTTP_CLIENT_IP to determine a visitor\u2019s IP address. By sending a forged header that contains the IP address of a legitimately authenticated user, an attacker can bypass the plugin\u2019s authorization checks and gain access to otherwise restricted content. This vulnerability results in an authorization bypass (CWE-285) but does not lead to remote code execution or other higher\u2011level impact.", "risk_and_exploitability": "The CVSS score of 3.7 indicates low overall severity, and the EPSS score of less than 1\u202f% suggests that widespread exploitation is currently unlikely. Because the problem requires a specific configuration (transients enabled and open HTTP headers), the attack vector is network\u2011based header spoofing, but the exploitability is limited by the need for the attacker to control request headers. The vulnerability is not listed in CISA\u2019s KEV catalog."}}}}, "created": "2025-10-27T22:10:23.557248+00:00", "updated": "2026-04-22T22:00:18.077469+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}