CVE-2025-15674
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Passster WordPress plugin before version 4.3.7 does not restrict low-privilege users with the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled. This allows any Contributor or higher to read protected pages and posts without knowing the password.
Risk Assessment
The risk includes unauthorized access to protected content, potentially compromising data confidentiality and the plugin's security.
Recommendation
Update the Passster plugin to version 4.3.7 or later, and review user permissions to limit access to protected content.
Original NVD description (English source)
The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.