CVE-2026-17559
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.
Risk Assessment
The risk is that unauthorized users may gain access to password-protected content, potentially leading to disclosure of sensitive information.
Recommendation
It is recommended to update the Passster plugin to version 4.3.9 or later, which contains the fix.
Other vulnerabilities in Passster
See all- CVE-2025-15674Low
The Passster WordPress plugin before version 4.3.7 does not restrict low-privilege users with the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled. This allows any Contributor or higher to read protected pages and posts without knowing the password.
- CVE-2026-16604High
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.
- CVE-2026-16603High
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.
- CVE-2026-16602High
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.
Original NVD description (English source)
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.