CVE-2026-16603
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.
Risk Assessment
An attacker can access content of posts that should be protected, potentially compromising confidentiality and integrity of content.
Recommendation
Update the Passster plugin to version 4.3.6 or later, which includes the fix.
Other vulnerabilities in Passster
See all- CVE-2026-17559Medium
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.
- CVE-2025-15674Low
The Passster WordPress plugin before version 4.3.7 does not restrict low-privilege users with the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled. This allows any Contributor or higher to read protected pages and posts without knowing the password.
- CVE-2026-16604High
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.
- CVE-2026-16602High
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.
Original NVD description (English source)
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.