CVE-2025-10720
BaseFortify
Publication date: 2025-10-13
Last updated on: 2025-10-28
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_private_content_plus | wp_private_content_plus | 3.6.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the WordPress plugin WP Private Content Plus version 3.6.2 and earlier. It allows an unauthenticated attacker to bypass the password protection feature by manually setting a specific client-side cookie named 'wppcp_global_password_protected_status' to the value 'ACTIVE' in their browser. The plugin relies solely on the presence of this cookie to verify password authentication, so by creating this cookie, the attacker gains unrestricted access to password-protected content without entering the actual password. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to access content that is supposed to be protected by a password. Since the protection can be bypassed simply by setting a cookie in the browser, sensitive or private content may be exposed to anyone, including unauthenticated attackers, leading to potential data leakage or unauthorized information disclosure. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the client-side cookie named `wppcp_global_password_protected_status` is present and set to "ACTIVE" in browsers accessing the protected content. You can inspect this cookie using browser developer tools or by running JavaScript commands such as `document.cookie` in the browser console to see if the cookie is set. Additionally, monitoring HTTP requests for the presence of this cookie can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Since there is currently no known fix for this vulnerability, immediate mitigation steps include disabling the WP Private Content Plus plugin or not using the global content protection feature until a patch is released. You can also restrict access to protected content by other means such as server-side authentication or access controls, and monitor for suspicious cookie manipulation attempts. [1]