Access violation vulnerability in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.7.11

The Password Protected plugin for WordPress has a security vulnerability that allows unauthorized access through IP address spoofing. This means that an attacker can trick the plugin into thinking they are a legitimate user by manipulating certain HTTP headers. This can only happen if the “Use transients” feature is turned on, which is not the default setting. If the website is not using a CDN or reverse proxy, these headers can be faked, giving the attacker access to the protected content.