The Password Protect Plugin for WordPress has a security issue called Cross-Site Request Forgery. This can happen in all versions up to 0.8.1.0. The problem is that the plugin doesn’t properly check for a special code, making it possible for people who are not logged in to change settings and add harmful code to the website. They can do this by tricking a site administrator into clicking on a link.