EUVD-2025-210831
GHSA-96qf-ff37-rrr4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Passster
-
DeliverySend unauthenticated AJAX request to admin-ajax.php
-
ExploitTrigger unguarded AJAX handler
-
ExecutionBypass password gate
-
ImpactRetrieve protected content value
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against any WordPress installation running Passster before version 4.2.24. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and no unusual server configuration is required. The sole prerequisite is that the target site has the Passster plugin installed, active, and has at least one content item configured as password-protected (i.e., the feature is in use). Exploitation is limited to content values protected by Passster; broader system data, WordPress credentials, or data outside the plugin's scope are not exposed by this flaw alone. |
| Impact | The provided CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is technically accurate in that only limited content data is disclosed rather than credentials or system data. However, context elevates real-world risk: the entire value proposition of Passster is content access control, and this flaw renders that control ineffective - for sites that rely on Passster to protect business-sensitive, subscription-gated, or restricted content, the business impact can substantially exceed what C:L implies. A public exploit from WPScan (a widely used, trusted vulnerability intelligence platform) further lowers the exploitation barrier to near-zero. EPSS data is not provided; however, the combination of zero prerequisites and a published PoC suggests meaningful near-term exploitation probability. No CISA KEV listing is noted at time of analysis. The flaw is not in CISA KEV and there are no SSVC signals indicating active exploitation, but the public PoC and trivial attack complexity make this a genuine patch-now priority for any site using the plugin. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running Passster before 4.2.24 - detectable via plugin enumeration or version disclosure in page source - and submits a crafted HTTP POST to the site's wp-admin/admin-ajax.php endpoint targeting the vulnerable AJAX action. The server, lacking authorization checks, returns the password-protected content value in the response, bypassing the intended password gate entirely. A public PoC from WPScan makes this repeatable with minimal attacker skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
RemediationAI
Upgrade Passster to version 4.2.24 or later - this is the vendor-released patch that resolves the improper input handling in the vulnerable AJAX action. Site administrators should apply this update immediately given the availability of a public exploit. As a temporary compensating control, deactivating the Passster plugin entirely via the WordPress admin panel eliminates the vulnerable endpoint, though this also removes all password-protection functionality the plugin provides. No other server-side workaround (such as blocking specific AJAX actions via WAF rule) is a reliable substitute for patching, as the action name would need to be confirmed from the plugin source. The WPScan advisory at https://wpscan.com/vulnerability/b1b4f64a-5bff-486e-a3e5-e71b5ca28d78/ should be monitored for any further updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Passster is a WordPress plugin designed to protect page or post content behind a password gate. The vulnerability exists in a WordPress AJAX action (wp_ajax_nopriv_ handler, accessible to unauthenticated users) that does not properly validate or authorize the incoming request before returning the protected content value. No CWE is formally assigned, but the root cause maps to CWE-862 (Missing Authorization) - the handler exposes sensitive output without verifying the caller holds the password. The affected product is identified by CPE cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:*, where 'unknown' is a placeholder for the true vendor slug. The WPScan advisory at https://wpscan.com/vulnerability/b1b4f64a-5bff-486e-a3e5-e71b5ca28d78/ is the primary intelligence source and also carries the exploit reference.
Know when Passster gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no authentication or interaction required; only limited content value is disclosed with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the publi
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to re
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encodin
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthentic
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attacke
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortc
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauth
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows u
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Exploit-DB