Password Protect Pages WordPress Plugin IDOR Vulnerability (CVE-2025-10005)

Vulnerability Overview Vulnerability Name: Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update CVE ID: CVE-2025-10005 CVSS Score: 4.3 (Medium) Publication Date: August 15, 2026 Last Updated: August 16, 2026 Researcher: Dmitri Ignatyev - CleanTalk Inc. Scope of Impact Software Type: Plugin Software Name: Password Protect Pages Affected Versions: <= 1.9.20 Fixed Version: 1.9.21 Remediation Recommendation: Update to version 1.9.21 or later. Vulnerability Description This vulnerability allows an authenticated attacker (at the Contributor level and above) to bypass validation by using a user-controlled key, thereby updating the password of any password-protected post and subsequently accessing the content. References research.cleantalk.org plugins.trac.wordpress.org Related Recent Vulnerabilities PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes - CVE ID: CVE-2026-3639 - CVSS Score: 6.4 - Researcher: Muhammad Yudha - DJ - Date: August 12, 2026 PPWP – Password Protect Pages <= 1.9.19 - Authenticated (Contributor+) Insecure Direct Object Reference - CVE ID: CVE-2026-57634 - CVSS Score: 4.3 - Researcher: Ananta Dhakal - Date: June 26, 2026 PPWP – Password Protect Pages <= 1.9.15 - Missing Authorization - CVE ID: CVE-2026-32562 - CVSS Score: 4.3 - Researcher: Doan Dinh Van (d52v) - Date: March 23, 2026 PPWP – Password Protect Pages <= 1.9.10 - Authenticated (Subscriber+) Content Exposure via REST API - CVE ID: CVE-2025-5998 - CVSS Score: 4.3 - Researcher: Pierre Rudloff - Date: August 25, 2025 PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure - CVE ID: CVE-2024-11280 - CVSS Score: 5.3 - Researcher: Francesco Carucci - Date: December 16, 2024 PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass - CVE ID: CVE-2024-0620 - CVSS Score: 5.3 - Researcher: Francesco Carucci - Date: February 7, 2024 PPWP – WordPress Password Protect Page <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2022-4626 - CVSS Score: 6.4 - Researcher: István Márton - Date: January 10, 2023 Additional Information Copyright: - 2012-2026 Defiant Inc. - 1999-2026 The MITRE Corporation Contact Information: - For more information or if errors are found, please contact: wfsupport@wordfence.com Business Hours: - 9am-8pm ET, 5am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) - 24-hour customer support, 365 days a year, with a 1-hour response time Terms of Service: - Terms of Service, Privacy Policy, and Notice of Collection of Personal Information, No Sale or Sharing of My Personal Information Products and Support: - Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central - Documentation, Learning Center, Free Support, Advanced Support News: - Blog, Latest News, Vulnerability Advisories About: - About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription: - Subscribe to News and Updates, provided by experienced security professionals Social Media: - X (Twitter), Facebook, LinkedIn, Email Payment: - Interact --- The above is a summary of key information regarding the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Password Protect Pages WordPress Plugin IDOR Vulnerability (CVE-2025-10005)

More from this source