PPWP Password Protect CVE-2025-10005

Exploitation requires an authenticated WordPress session with at least Contributor-level role - unauthenticated visitors and Subscriber-level users (below Contributor) cannot exploit this flaw, as confirmed by the CVSS PR:L metric. The PPWP - Password Protect Pages plugin must be installed and active on the target site; the vulnerable AJAX action (ppw_free_set_password) is only registered when the plugin is enabled. No non-default configuration is required beyond plugin activation - any password-protected post on the site is a valid target once the plugin is active. Exploitation is bounded to the WordPress site's own content; it does not provide server-level access or affect other WordPress installations. The primary limiting factor is the Contributor-level authentication requirement, which reduces exposure on sites that do not grant accounts to untrusted external users.

The NVD/Wordfence CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately captures the authentication prerequisite (Contributor-level, PR:L) and low attack complexity, but the I:N metric arguably understates impact: unauthorized password modification of arbitrary posts is itself an unauthorized write operation, representing data integrity impact beyond just disclosure. No EPSS score was supplied in the available data; risk cannot be quantified probabilistically from this dataset. No CISA KEV listing and no public proof-of-concept exploit have been identified. Real-world risk is materially elevated on multi-author WordPress sites (blogs, news sites, membership platforms) where Contributor accounts are granted to semi-trusted or user-registered parties - a common deployment pattern. Sites where Contributors are fully trusted internal staff face negligible real-world risk despite the technical vulnerability. The practical impact exceeds what C:L implies: if the protected posts contain premium or sensitive content, an attacker who sets a known password gains full read access to that content, not merely a partial disclosure.

An attacker who holds or obtains a Contributor-level WordPress account on a target site crafts an authenticated AJAX POST request to the WordPress admin-ajax endpoint invoking ppw_free_set_password, supplying the post ID of any password-protected post and a chosen plaintext password. Because the handler applies the password without validating the requester's relationship to that post, the protection is immediately overwritten. The attacker then visits the post URL, submits their chosen password, and reads the previously restricted content in full.