CVE-2025-10005
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The PPWP plugin for WordPress up to version 1.9.20 is vulnerable to Insecure Direct Object Reference via the ppw_free_set_password AJAX action due to missing validation on a user-controlled key. Authenticated attackers with Contributor-level access can update the password on any password-protected post and subsequently access the content.
Risk Assessment
The risk includes unauthorized access to protected content, breach of data confidentiality. However, the attack requires a contributor account, limiting access.
Recommendation
Update the plugin to the latest version. Also restrict user permissions and monitor AJAX activity.
Original NVD description (English source)
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.