EUVD-2025-210644
GHSA-wqxf-2hrv-jrwq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
WordPress Contributor is basic authenticated access (PR:L, not PR:H); all other metrics align with the provided vector - network delivery, low complexity, read-only confidentiality impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
2DescriptionCVE.org
The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.
AnalysisAI
Passster WordPress plugin before 4.3.7 allows any authenticated Contributor or higher to bypass global password protection and read protected content via the WordPress core REST API without supplying the protection password. When global protection is enabled, the plugin enforces its access controls only on direct front-end page requests, leaving the REST API path unrestricted for users holding the edit_posts capability. No public exploit has been identified at time of analysis; the CVSS score of 2.7 reflects realistic low risk, constrained to sites with untrusted registered contributors.
Technical ContextAI
Passster is a WordPress content protection plugin that gates pages and posts behind a password using its own access control layer. The root cause is an incomplete authorization implementation: the plugin enforces password requirements on the standard WordPress page-rendering path but fails to apply equivalent restrictions to the WordPress core REST API endpoints (e.g., /wp-json/wp/v2/posts, /wp-json/wp/v2/pages). This is a classic authorization bypass via alternate access path - protection logic is applied to one channel but not another. The edit_posts capability is granted to the Contributor role by default in WordPress, making this exploitable by any registered contributor on a multi-author site. No formal CWE is assigned in the source data, but this maps conceptually to CWE-863 (Incorrect Authorization). The WPScan advisory at https://wpscan.com/vulnerability/1bcf4ddd-ce9c-40bc-80f7-54ad9f23f39a/ provides the primary technical reference.
RemediationAI
Update the Passster WordPress plugin to version 4.3.7 or later, which resolves the authorization bypass. Updates can be applied directly through the WordPress admin dashboard under Plugins > Updates. Reference the WPScan advisory at https://wpscan.com/vulnerability/1bcf4ddd-ce9c-40bc-80f7-54ad9f23f39a/ for confirmation. If immediate upgrade is not feasible, a targeted compensating control is to restrict WordPress REST API access for authenticated low-privilege users via the rest_authentication_errors filter in a must-use plugin, effectively requiring elevated authentication to consume API responses - note that this may break other plugins relying on the REST API for Contributors and should be tested carefully. Alternatively, auditing and reducing the number of accounts holding the edit_posts capability limits exposure without affecting site functionality.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today