CVE-2025-10305 Overview
CVE-2025-10305 affects the Secure Passkeys plugin for WordPress in all versions up to and including 1.2.1. The vulnerability stems from missing capability checks on the delete_passkey() and passkeys_list() functions. Authenticated attackers with Subscriber-level access or above can view and delete passkeys belonging to other users. The flaw is categorized under CWE-862: Missing Authorization.
Critical Impact
Low-privileged authenticated users can enumerate and delete passkeys registered by other WordPress accounts, degrading account recovery integrity and enabling targeted denial of authentication.
Affected Products
- Secure Passkeys plugin for WordPress, versions up to and including 1.2.1
- WordPress sites using passkey-based authentication provided by this plugin
- Any multi-user WordPress deployment with the vulnerable plugin activated
Discovery Timeline
- 2025-09-20 - CVE-2025-10305 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10305
Vulnerability Analysis
The Secure Passkeys plugin exposes two functions — delete_passkey() and passkeys_list() — without validating the caller's WordPress capability. WordPress authorization relies on functions such as current_user_can() to gate privileged operations. When these checks are absent, any authenticated session can invoke the underlying AJAX or REST endpoints. Attackers with the lowest role (Subscriber) can list all registered passkeys and delete arbitrary entries. This breaks the isolation that a passkey management interface must enforce between accounts.
Root Cause
The root cause is a missing authorization check [CWE-862]. The plugin registers handlers that process passkey listing and deletion requests but omits both a role or capability check and an ownership check tying the target passkey to the requesting user. Nonce verification alone, if present, does not restrict the action to privileged users. The result is a broken access control primitive on security-critical authenticator data.
Attack Vector
Exploitation requires only a valid low-privilege WordPress account, which many sites grant through self-registration. An attacker authenticates, obtains a valid session, and issues requests to the plugin's passkey management endpoints. Because the confidentiality impact is scoped to passkey metadata and the integrity impact is limited to deletion, the vulnerability does not directly grant account takeover. However, deleting an administrator's passkey can force fallback authentication paths and enable follow-on attacks. Technical details are available in the Wordfence Vulnerability Report and the WordPress Changeset Update.
Detection Methods for CVE-2025-10305
Indicators of Compromise
- Unexpected passkey deletion events in WordPress user metadata or plugin logs
- Requests to Secure Passkeys AJAX or REST endpoints originating from Subscriber or Contributor accounts
- Administrator or Editor accounts reporting missing or invalidated passkeys
- Spikes in passkey list retrieval requests from newly registered low-privilege users
Detection Strategies
- Audit web server access logs for POST requests to the plugin's delete_passkey and passkeys_list handlers correlated with non-administrative user IDs
- Compare current passkey inventories against backup snapshots to identify unauthorized deletions
- Alert on WordPress user_meta changes affecting passkey storage keys outside expected administrative workflows
Monitoring Recommendations
- Enable WordPress activity logging plugins to record authentication and plugin-level actions
- Forward WordPress and web server logs to a centralized SIEM for correlation across user roles and endpoints
- Monitor account registration trends for anomalous Subscriber creation preceding passkey-related requests
How to Mitigate CVE-2025-10305
Immediate Actions Required
- Update the Secure Passkeys plugin to a version above 1.2.1 once the vendor publishes a fixed release
- Disable the Secure Passkeys plugin if a patched version is not yet available and passkey authentication is non-essential
- Restrict or disable open user registration to reduce the pool of accounts able to exploit the flaw
- Review passkey inventories for administrator and editor accounts and re-register any that were removed
Patch Information
The fix is tracked in the WordPress plugin changeset 3363280, which adds the missing capability enforcement. Administrators should upgrade to the first plugin release that incorporates this changeset. Confirm the installed version through the WordPress plugins dashboard after update.
Workarounds
- Set users_can_register to false in WordPress General Settings until the plugin is patched
- Apply a web application firewall rule to block requests to the plugin's passkey endpoints from users below Administrator role
- Temporarily deactivate the plugin and rely on alternative multi-factor authentication mechanisms
# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0
# Verify installed Secure Passkeys plugin version
wp plugin get secure-passkeys --field=version
# Deactivate the plugin until a patched release is installed
wp plugin deactivate secure-passkeys
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
