What is the CVSS score of EUVD-2025-210731?

EUVD-2025-210731 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

PPWP Password Protect EUVD-2025-210731

| CVE-2025-10005 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-16 Wordfence

GHSA-5fxx-hjg5-h5pq

WordPress Authentication Bypass Wordpress Plugin Ppwp Password Protect Pages Buildwps

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.4 MEDIUM

Unauthorized password modification of arbitrary posts constitutes an integrity impact (I:L) absent from the vendor vector; all other metrics align with the authenticated network-exploitable IDOR.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 05:11 vuln.today

CVE Published

Aug 16, 2026 - 04:24 cve.org

MEDIUM 4.3

DescriptionCVE.org

The PPWP - Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.

AnalysisAI

Insecure Direct Object Reference in the PPWP - Password Protect Pages WordPress plugin (all versions ≤ 1.9.20) allows any authenticated Contributor-level user to overwrite the password on any password-protected post site-wide, then access that previously restricted content. The vulnerability exists in the ppw_free_set_password AJAX handler, which accepts a user-controlled post identifier without verifying the requesting user's authorization over the target object (CWE-639). No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; a fix commit is available in the WordPress plugin repository.

Technical ContextAI

The affected product is the PPWP - Password Protect Pages plugin for WordPress (CPE: cpe:2.3:a:buildwps:ppwp_-_password_protect_pages:*:*:*:*:*:*:*:*), a plugin that wraps WordPress's native post-password feature with enhanced per-page access controls. The root cause is CWE-639 (Authorization Through User-Controlled Key): the ppw_free_set_password AJAX endpoint accepts a post ID - a user-supplied integer reference - and applies a new password to the identified post without first verifying that the authenticated user has any ownership or editorial rights over that specific post. WordPress contributors can legitimately create and submit posts but are not authorized to edit other users' content; the missing object-level authorization check collapses this boundary. This is a classic broken object-level authorization (BOLA/IDOR) pattern prevalent in WordPress plugin AJAX handlers that rely solely on nonce validation without subsequent resource-ownership checks.

RemediationAI

Update the PPWP - Password Protect Pages plugin to a version beyond 1.9.20. A code-level fix has been committed to the WordPress plugin SVN repository (changeset referenced at plugins.trac.wordpress.org/changeset?reponame=&old=3637624%40password-protect-page&new=3637624%40password-protect-page); however, the exact released patched version number is not independently confirmed from the available data - verify the current plugin version in the WordPress.org plugin directory before updating. As an interim compensating control, audit and restrict Contributor-level accounts on the affected WordPress installation to only fully trusted internal users, eliminating the untrusted-contributor attack surface entirely. Alternatively, deactivating the PPWP plugin will remove the vulnerable AJAX endpoint; note this will also remove all existing password protections the plugin manages, potentially exposing previously restricted content. There are no known non-disruptive workarounds short of patching or account restriction.