What is the CVSS score of CVE-2025-15489?

CVE-2025-15489 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-15489?

Yes, a public proof-of-concept exploit is available for CVE-2025-15489. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2025-15489?

Yes, a patch is available for CVE-2025-15489. Update the affected software to the latest version immediately.

Passster CVE-2025-15489

EUVD-2025-210831 MEDIUM

Incorrect Authorization (CWE-863)

2026-09-02 WPScan

GHSA-96qf-ff37-rrr4

WordPress Authentication Bypass Passster Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication or interaction required; only limited content value is disclosed with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 02, 2026 - 16:02 EUVD

Analysis Generated

Sep 02, 2026 - 15:16 vuln.today

CVE Published

Sep 02, 2026 - 14:25 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content

AnalysisAI

Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.

Technical ContextAI

Passster is a WordPress plugin designed to protect page or post content behind a password gate. The vulnerability exists in a WordPress AJAX action (wp_ajax_nopriv_ handler, accessible to unauthenticated users) that does not properly validate or authorize the incoming request before returning the protected content value. No CWE is formally assigned, but the root cause maps to CWE-862 (Missing Authorization) - the handler exposes sensitive output without verifying the caller holds the password. The affected product is identified by CPE cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:*, where 'unknown' is a placeholder for the true vendor slug. The WPScan advisory at https://wpscan.com/vulnerability/b1b4f64a-5bff-486e-a3e5-e71b5ca28d78/ is the primary intelligence source and also carries the exploit reference.

RemediationAI

Upgrade Passster to version 4.2.24 or later - this is the vendor-released patch that resolves the improper input handling in the vulnerable AJAX action. Site administrators should apply this update immediately given the availability of a public exploit. As a temporary compensating control, deactivating the Passster plugin entirely via the WordPress admin panel eliminates the vulnerable endpoint, though this also removes all password-protection functionality the plugin provides. No other server-side workaround (such as blocking specific AJAX actions via WAF rule) is a reliable substitute for patching, as the action name would need to be confirmed from the plugin source. The WPScan advisory at https://wpscan.com/vulnerability/b1b4f64a-5bff-486e-a3e5-e71b5ca28d78/ should be monitored for any further updates.