CVE-2025-10005 buildwps CVE debrief

Who should care

WordPress administrators and users with Contributor-level access or above should assess exposure and take defensive actions to prevent exploitation. This includes reviewing and updating the PPWP – Password Protect WordPress plugin, restricting access to the ppw_free_set_password AJAX action, and monitoring for suspicious activity related to password updates on protected posts.

Why it matters

The Insecure Direct Object Reference vulnerability in the PPWP – Password Protect WordPress plugin allows authenticated attackers to update passwords on protected posts, potentially leading to unauthorized access to sensitive content. WordPress administrators and users with Contributor-level access or above should assess exposure and take defensive actions to prevent exploitation.

• Authenticated attackers with Contributor-level access can update passwords on protected posts.
• Successful exploitation allows access to protected content.

Technical summary

The PPWP – Password Protect WordPress plugin is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This vulnerability allows authenticated attackers with Contributor-level access and above to update the password on any password protected post and subsequently access the content. The vulnerability has a CVSS score of 4.3 and MEDIUM severity, indicating a moderate level of risk. WordPress administrators and users with Contributor-level access or above should assess exposure and take defensive actions to prevent exploitation.

Defensive priority

Medium-priority defensive actions are recommended to address the Insecure Direct Object Reference vulnerability in the PPWP – Password Protect WordPress plugin.

Recommended defensive actions

• Review and update the PPWP – Password Protect WordPress plugin to the latest version.
• Restrict access to the ppw_free_set_password AJAX action.
• Monitor for suspicious activity related to password updates on protected posts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 4.3 and MEDIUM severity. The vulnerability was disclosed on 2026-08-16T05:16:44.747Z. The CVE Program and NVD entries provide additional context and details on the vulnerability. The vulnerability has not been modified since its initial publication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.