CVE-2025-11255: 
WordPress vulnerability analysis and mitigation

The Password Policy Manager | Password Manager plugin for WordPress contains a vulnerability (CVE-2025-11255) discovered in versions up to 2.0.5. The vulnerability stems from a missing capability check on the 'moppm_ajax' AJAX endpoint, which allows authenticated users with Subscriber-level access or higher to perform unauthorized modifications (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), needs low privileges (PR:L), requires no user interaction (UI:N), has unchanged scope (S:U), no impact on confidentiality (C:N), low impact on integrity (I:L), and no impact on availability (A:N) (NVD, Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to log out the site's connection to miniorange, potentially disrupting password policy management services (NVD).

The vulnerability has been patched in version 2.0.6 of the Password Policy Manager plugin. Users are advised to update to this latest version to mitigate the security risk (WordPress Plugin).