THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-10005 (MEDIUM 4.3) — The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled ke

[NVD] CVE-2025-10005 (MEDIUM 4.3) — The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled ke

mednvdPublished 2026-08-16

CVE-2025-10005 CVSS: 4.3 MEDIUM Published: 2026-08-16T05:16:44.747

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attacker

Indicators of compromise

CVE-2025-10005cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-10005