medium6.5
CVE-2025-10720
The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password.
Impact
The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
Affected products
| Product | Affected versions |
|---|---|
| WP Private Content Plus | through 3.6.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.