PT-2025-38630 · WordPress · Secure Passkeys

Published 2025-09-20 · Updated 2025-09-20 · CVE-2025-10305

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Secure Passkeys plugin for WordPress versions up to and including 1.2.1

Description The Secure Passkeys plugin for WordPress is susceptible to unauthorized access due to a missing capability check within the delete passkey() and passkeys list() functions. This allows authenticated attackers with Subscriber-level access or higher to view and delete passkeys.

Recommendations Update the Secure Passkeys plugin to a version beyond 1.2.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10305

Affected Products

Secure Passkeys

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10305 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c41651ce-ee9b-408f-a25f-113d71beb935?source=cve · Note
• https://t.me/CVEtracker/32988 · Telegram Post
• https://twitter.com/CVEnew/status/1969291920913400037 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363280%40secure-passkeys&new=3363280%40secure-passkeys&sfp_email=&sfph_mail=#file2 · Note