CVE-2025-10720

The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.

• https://wpscan.com/vulnerability/5295e8da-7aba-4322-981b-80d692b3bc35/

Published

Oct 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10715A security flaw has been discovered in APEUni PTE Exam Pract…5.3
• CVE-2025-10716A flaw has been found in Creality Cloud App up to 6.1.0 on A…5.3
• CVE-2025-10717A vulnerability has been found in intsig CamScanner App 6.91…5.3
• CVE-2025-10718A vulnerability was found in Ooma Office Business Phone App …5.3
• CVE-2025-10719Tronclass developed by WisdomGarden has an Insecure Direct o…5.3
• CVE-2025-1072A Denial of Service (DoS) issue has been discovered in GitLa…6.5
• CVE-2025-10721A vulnerability was determined in Webull Investing & Trading…5.3
• CVE-2025-10722A vulnerability was detected in SKTLab Mukbee App 1.01.196 o…5.3
• CVE-2025-10723The PixelYourSite WordPress plugin before 11.1.2 does not v…2.7
• CVE-2025-10725A flaw was found in Red Hat Openshift AI Service. A low-priv…9.9
• CVE-2025-10726The WPRecovery plugin for WordPress is vulnerable to SQL Inj…9.1
• CVE-2025-10727Improper Neutralization of Input During Web Page Generation …5.4