Passive continuous-variable quantum key distribution (CV-QKD) employs a thermal source and a variable optical attenuator (VOA) to prepare quantum states, simplifying the transmitter while avoiding security vulnerabilities associated with classical optical modulators. However, the practical security related to the VOA remains unexplored, despite its influence on both the modulation variance and the preparation noise. In this work, we investigate the practical security of passive CV-QKD against an induced-photorefractive attack (IPA) targeting the VOA. In particular, the eavesdropper Eve injects light into a lithium niobate-based VOA to induce the photorefractive effect (PE) within the dual-waveguide structure, thereby altering the attenuation factor. We develop a model to characterize the attenuation factor variations and show how it depends on irradiation intensity and waveguide fabrication technology, including proton-exchanged and annealed-proton-exchanged waveguides. Then, we analyze the resulting biases in parameter estimation, evaluate the performance of equivalent entanglement distribution, and derive a lower bound on the composable finite-size secret key rate. Numerical results show that the passive protocol is more susceptible to IPA than the conventional active protocol under the same irradiation conditions. Although proton-exchanged waveguides exhibit better resistance to PE than annealed-protonexchanged waveguides, the passive protocol using proton-exchanged waveguides has security vulnerabilities at irradiation intensities as low as approximately 2 W/cm².