CVE-2025-10720: Unknown Wp Private Content Plus

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.

Affected products

• Unknown Wp Private Content Plus: up to and including 3.6.2

Published 2025-10-13. Last modified 2026-10-08.