CVE-2025-10720

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-107215.3A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file A CVE-2025-107225.3A vulnerability was detected in SKTLab Mukbee App 1.01.196 on Android. This affects an unknown function of the file AndroidManifest.xml of t CVE-2025-107232.7The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to functi CVE-2025-107259.9A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data s CVE-2025-107269.1The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. T CVE-2025-107275.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware CVE-2025-107289.4When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS CVE-2025-107299.4The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be acces CVE-2025-10737.5Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware ont CVE-2025-107306.5The Wp tabber widget plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and inc CVE-2025-107315.3The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulner CVE-2025-107324.3The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versi