Insecure Direct Object Reference in PPWP Password Protect WordPress Plugin
CVE-2025-10005

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
PpWP – Password Protect Pages
Vendor
CVE Published:
16 August 2026

What is CVE-2025-10005?

The PPWP – Password Protect WordPress plugin is susceptible to an Insecure Direct Object Reference, affecting all versions up to 1.9.20. This vulnerability arises from inadequate validation on a user-controlled key within the ppw_free_set_password AJAX action. As a result, authenticated attackers with Contributor-level access or higher can change passwords for any password-protected posts, granting them unauthorized access to restricted content.

Affected Version(s)

PPWP – Password Protect Pages 0 <= 1.9.20

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://research.cleantalk.org/CVE-2025-10005
https://plugins.trac.wordpress.org/changeset?reponame=&ol...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.