What is the CVSS score of CVE-2025-15490?

CVE-2025-15490 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-15490?

Yes, a public proof-of-concept exploit is available for CVE-2025-15490. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2025-15490?

Yes, a patch is available for CVE-2025-15490. Update the affected software to the latest version immediately.

Passster CVE-2025-15490

EUVD-2025-210832 MEDIUM

Incorrect Authorization (CWE-863)

2026-09-02 WPScan

GHSA-r64m-vg32-6jh4

WordPress Authentication Bypass Passster Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Fully remote unauthenticated URL-based bypass; C:L reflects access to plugin-protected pages only, not admin, database, or file system access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 02, 2026 - 16:02 EUVD

Analysis Generated

Sep 02, 2026 - 15:16 vuln.today

CVE Published

Sep 02, 2026 - 14:25 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs

AnalysisAI

Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.

Technical ContextAI

Passster is a WordPress plugin designed to restrict access to pages, posts, or entire sites behind password gates - its core function is access control for WordPress content. The vulnerability resides in the plugin's 'global protection' enforcement logic, which evaluates incoming requests to determine whether access should be granted or denied. The flaw appears to involve insufficient or bypassable URL-based checks, allowing a specially crafted URL to satisfy or skip the protection condition without providing valid credentials. The CWE is listed as N/A in available data; conceptually this aligns with CWE-288 (Authentication Bypass Using an Alternate Path) or CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The CPE cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:* covers all versions before 4.2.26, with 'unknown' used as a vendor placeholder - a common NVD data gap for small WordPress plugins.

RemediationAI

Update the Passster WordPress plugin to version 4.2.26 or later, which addresses the global protection bypass. The fix is documented in the WPScan advisory at https://wpscan.com/vulnerability/87d4768e-48a5-4d91-a5e1-8a84ba2de035/. For sites that cannot immediately update, implement server-level access controls as compensating measures: restrict access to protected WordPress routes via HTTP Basic Authentication configured in the web server (e.g., .htaccess on Apache or auth_basic in nginx) or apply IP allowlisting for sensitive content areas. Note that these workarounds require web server access and may affect legitimate users who access content from variable IP addresses. Disabling the global protection feature entirely removes the bypass surface but also removes all content protection, which is only acceptable as a temporary measure while patching.