CVE-2025-10005

MediumCVSS 4.3

Published: 16/08/2026(UTC)Updated: 29/09/2026(UTC)Translated: 16/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

The PPWP plugin for WordPress up to version 1.9.20 is vulnerable to Insecure Direct Object Reference via the ppw_free_set_password AJAX action due to missing validation on a user-controlled key. Authenticated attackers with Contributor-level access can update the password on any password-protected post and subsequently access the content.

Risk Assessment

The risk includes unauthorized access to protected content, breach of data confidentiality. However, the attack requires a contributor account, limiting access.

Recommendation

Update the plugin to the latest version. Also restrict user permissions and monitor AJAX activity.

Other vulnerabilities in PPWP

CVE-2025-9878Medium
The PPWP – Password Protect WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'ppwp' shortcode in versions up to and including 1.9.21. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute whenever a user accesses the affected page.

Original NVD description (English source)

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS