CVE-2026-16983
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Gutentor WordPress plugin before version 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
Risk Assessment
The risk is the disclosure of passwords for protected content to low-privileged users, potentially leading to unauthorized access to sensitive information.
Recommendation
Update the Gutentor plugin to version 4.0.6 or later, which fixes this issue.
Other vulnerabilities in Gutentor
See all- CVE-2025-58680Medium
The Gutentor plugin (versions up to and including 3.5.2) contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
- CVE-2025-58783Medium
Missing Authorization vulnerability in the Gutentor WordPress plugin (versions up to and including 3.5.5) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS