CVE-2025-10720 — WP Private Content Plus <= 3.6.2 - Password Protection Bypass
The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence …
Published: 2025-10-13 · CVSS: 6.5 · CVSS 3.1
The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7