CVE-2025-9034: 
WordPress vulnerability analysis and mitigation

The Wp Edit Password Protected WordPress plugin before version 1.3.5 contains an Open Redirect vulnerability identified as CVE-2025-9034. The vulnerability was discovered and publicly disclosed on August 21, 2025, by security researcher Bob Matyas (WPScan).

The vulnerability stems from the plugin's failure to validate a parameter before redirecting users to its value, resulting in an Open Redirect issue. The vulnerability has been assigned a CVSS 3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-601 and falls into the OWASP Top 10 category A1: Injection (WPScan, NVD).

The Open Redirect vulnerability could allow attackers to redirect users to malicious websites, potentially leading to phishing attacks or other social engineering attempts. The CVSS scoring indicates low impact on confidentiality and integrity, with no impact on availability (NVD).

Users are advised to upgrade to Wp Edit Password Protected version 1.3.5 or later, which contains the fix for this vulnerability (WPScan).