Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-6786: WordPress DocCheck Login plugin allows anyone to read password-protected posts
CVE-2025-6786 · published 1 year ago
Summary
The DocCheck Login plugin for WordPress fails to properly redirect users to password-protected content, allowing unauthorized users to read posts they shouldn't have access to. This is a concern if your WordPress site uses password protection for sensitive information. Update the plugin to a version higher than 1.1.5 to fix the issue.
Original advisory text
The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protec...
The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protected post after the page has loaded. This makes it possible for unauthenticated attackers to read posts they should not have access to.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-284Improper Access Control
Timeline
Published4 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-6786 · NVD
Track software like this
Free during beta