CVE-2026-89283
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The WP Posts Password Batch Manager WordPress plugin through version 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler. This allows unauthenticated attackers to reset or overwrite the password of every published post.
Risk Assessment
An unauthenticated attacker can disclose password-protected content or lock all posts behind an attacker-chosen password, leading to data leakage and loss of content availability.
Recommendation
Update the WP Posts Password Batch Manager plugin to a version newer than 1.1 or disable it if no fix is available. Check post passwords and restore correct values.
Related vulnerabilities
- CVE-2026-79876Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79875Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79874Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79873Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79872Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79871Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79870Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79869Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79868Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79867Critical
No vulnerability description is available in the NVD. The nature and scope of the issue cannot be determined from the provided data.
Original NVD description (English source)
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS