CVE-2025-23435: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in David Marcucci's Password Protect Plugin for WordPress, affecting versions through 0.8.1.0. The vulnerability was disclosed on January 16, 2025, and assigned identifier CVE-2025-23435. The issue affects the plugin's functionality and allows for Stored Cross-Site Scripting (XSS) attacks (NVD, WPScan).

The vulnerability stems from missing or incorrect nonce validation on a function within the Password Protect Plugin for WordPress. The CVSS v3.1 base score is 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (Patchstack).

The vulnerability enables unauthenticated attackers to update settings and inject malicious web scripts through forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a link (WPScan).

The vulnerability requires user interaction, specifically requiring an administrator to be tricked into performing certain actions. The attack can be executed by unauthenticated attackers who can craft forged requests to exploit the CSRF vulnerability (Patchstack).

Currently, there is no known fix available for this vulnerability as it affects versions through 0.8.1.0. Website administrators should consider implementing additional security measures or evaluating alternative plugins until a patch is released (WPScan).