Wp Edit Password Protected – Create Password Protect Pages & Design Password Protected Form Security & Risk Analysis

The "wp-edit-password-protected" plugin version 1.3.7 exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface and vulnerability history. The plugin exposes 5 AJAX handlers, with a concerning 4 of them lacking proper authentication checks. This creates a substantial entry point for potential attacks that could be leveraged by authenticated users, or if further vulnerabilities exist to gain initial access. The presence of a `create_function` call, though only one instance, is a notable code smell that can lead to security issues if not handled with extreme care. Furthermore, the plugin has a history of 2 medium severity CVEs, specifically related to 'Open Redirect' and 'Missing Authorization'. While currently unpatched, this history suggests a recurring pattern of vulnerabilities in authorization logic, which aligns with the static analysis findings of unprotected AJAX handlers. The last vulnerability being in 2025 indicates a recent history of security flaws. In conclusion, while the plugin has some solid security implementations, the significant number of unprotected AJAX endpoints and its past vulnerability record, particularly concerning authorization, present tangible risks that require attention.