CVE-2025-31019: WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.
Other sources
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through 2.0.4.
— NVD
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31019?
CVE-2025-31019 is classified as a high-severity vulnerability allowing authentication bypass.
How do I fix CVE-2025-31019?
To mitigate CVE-2025-31019, update the miniOrange Password Policy Manager to version 2.0.5 or later.
What type of vulnerability is CVE-2025-31019?
CVE-2025-31019 is an authentication bypass vulnerability affecting the miniOrange Password Policy Manager.
Which versions are affected by CVE-2025-31019?
CVE-2025-31019 impacts miniOrange Password Policy Manager versions up to and including 2.0.4.
What can attackers do with CVE-2025-31019?
Attackers can exploit CVE-2025-31019 to gain unauthorized access to user accounts by bypassing authentication mechanisms.