Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-23 | 4 | Disclosure4 |
| 2026-08-24 | 1 | Disclosure1 |
ページをパスワードで隠すプラグインPPWPに、PHPオブジェクトインジェクションの脆弱性（CVE-2026-0551）をWordfenceが公開したモー🐮 隠すために入れた部品が、そのまま入口になるモー🐄
Post summary
Wordfence disclosed CVE-2026-0551, a PHP object injection flaw in the PPWP password‑hide plugin, without mentioning any PoC, exploitation, or mitigation.
🆕👉 PPWP Password Protect Pages https://wpdeeply.com/ppwp-password-protect-pages-1-9-18-php-object-injection/ #loreleiweb Wordfence Intelligence published CVE-2026-0551 on August 22, 2026 for PPWP – Password Protect Pages, a WordPress content-protection plugin with 30,000+ active installations. The vulnerability is a PHP Object… https://t.co/CrX2y1RB2W
Post summary
Wordfence Intelligence has published a new CVE (CVE-2026-0551) for the PPWP WordPress plugin, identifying a PHP Object Injection flaw; no PoC, exploit, or patch details are provided in the tweet.
WordPress sites using PPWP Password Protect Pages plugin (≤1.9.18) have a CVSS 8.8 vulnerability (CVE-2026-0551). Verify and update if in use: https://nvd.nist.gov/vuln/detail/CVE-2026-0551 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/7exjlrNL70
Post summary
A short tweet alerts WordPress users to a CVSS 8.8 vulnerability (CVE‑2026‑0551) affecting the PPWP Password Protect Pages plugin (≤1.9.18) and directs them to the NVD page for further information.
🚨*CVE* CVE-2026-0551 The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrust… https://www.cve.org/CVERecord?id=CVE-2026-0551 ----- Traducción: CVE-2026-0551 El … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑0551 as a PHP Object Injection flaw in the PPWP – Password Protect Pages WordPress plugin (versions ≤1.9.18) but offers no evidence of exploitation, PoC, or mitigation.
CVE-2026-0551 The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrust… https://www.cve.org/CVERecord?id=CVE-2026-0551
Post summary
The PPWP WordPress plugin (v1.9.18 and earlier) is vulnerable to PHP Object Injection via deserialization of untrusted data, as identified by CVE‑2026‑0551.