CVE-2025-6786 is an improper access control vulnerability (CWE-284) in the antwerpes DocCheck Login WordPress plugin. The issue arises because the plugin delays redirecting unauthenticated users to the login page until after a password-protected post has loaded, enabling unauthorized reading of protected posts. This affects all versions up to and including 1.1.5. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality only.

An unauthenticated attacker can read posts that are intended to be password-protected, leading to unauthorized disclosure of potentially sensitive content. There is no impact on integrity or availability reported. No known exploits are currently documented in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to sensitive content by alternative means or disabling the plugin if possible.