WP Private Content Plus, CVE-2025-10720

CVE, Research URL: CVE-2025-10720
Home page URL: Security reports for WP Private Content Plus
Application: WP Private Content Plus
Published on: Oct 13, 2025
Research Description: The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
Affected versions: max 3.6.2.
Status: vulnerable