CVE-2025-10005

Name of the Vulnerable Software and Affected Versions PPWP – Password Protect WordPress versions prior to 1.9.21

Description An Insecure Direct Object Reference (IDOR) exists in the ppw free set password AJAX action. This issue occurs because of missing validation on a user-controlled key, allowing authenticated attackers with Contributor-level access or higher to update the password of any password-protected post and gain unauthorized access to its content.

Recommendations Update to a version newer than 1.9.20.