CVE-2025-10005: Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: PPWP – Password Protect WordPress | #1 Most-Reviewed Password Pluginto a version that resolves this vulnerability.Fixed in 1.9.20Patch ppw_free_set_password
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10005?
CVE-2025-10005 has a medium severity rating of 4.3.
How do I fix CVE-2025-10005?
To mitigate CVE-2025-10005, update the PPWP – Password Protect WordPress plugin to version 1.9.21 or later.
What type of vulnerability is CVE-2025-10005?
CVE-2025-10005 is classified as an Insecure Direct Object Reference vulnerability.
Who is affected by CVE-2025-10005?
CVE-2025-10005 affects all versions of the PPWP – Password Protect WordPress plugin up to and including 1.9.20.
What can attackers do with CVE-2025-10005?
Attackers can exploit CVE-2025-10005 to update passwords of password-protected posts without proper authorization.