Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-10720. PoCs published by lorenzocamilli.
AI-analyzed exploit summary This repository contains a functional CSRF PoC for CVE-2025-10720, targeting the Contest Gallery WordPress plugin. The exploit demonstrates how an attacker can trick an authenticated user into deleting gallery items via a crafted HTML form submission.
Description
The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
Exploits (2)
This repository contains a functional CSRF PoC for CVE-2025-10720, targeting the Contest Gallery WordPress plugin. The exploit demonstrates how an attacker can trick an authenticated user into deleting gallery items via a crafted HTML form submission.
This repository contains a writeup describing an authentication bypass vulnerability in the WordPress plugin WP Private Content Plus v3.6.2. The issue allows unauthenticated users to bypass password-protected content due to improper reliance on client-side cookies.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N