WP Chill Passster CVE-2026-110896

The target site must have the Passster (content-protector) plugin installed and actively used to restrict content via its access-control security levels - the flaw only matters where content is gated, since it defeats that specific protection. Exploitation requires no authentication, no user interaction, and no non-default configuration per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any publicly reachable site running Passster <= 4.3.18 with protected content is exposed. The practical limit on impact is scope: only confidentiality of the Passster-gated content is affected (C:L, I:N, A:N) - no data modification, code execution, or site takeover results, and sites not using Passster's protection feature are unaffected.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the WP Chill Passster WordPress plugin, scored CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low-complexity, unauthenticated, affecting only confidentiality at a low level. The real-world risk is best characterized as low-to-moderate: the attack is trivially reachable (no auth, no user interaction, low complexity) but the impact is narrow - Passster's entire purpose is to gate content behind passwords/access levels, so a broken access control defeats that protection and exposes the specific content the operator intended to hide (C:L, no I/A impact). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or widespread exploitation; this is a single-source (Patchstack) advisory. SSVC-style framing: exploitation is 'none' observed, technical impact is partial, and automatability is plausible given the unauthenticated network vector - but the limited confidentiality-only impact keeps this out of emergency-patch territory. Treat as a routine prioritized patch for sites that actually rely on Passster for content gating rather than a broad-fleet emergency.

A remote, unauthenticated attacker requests a URL or endpoint for content that a site owner has restricted behind Passster's password/access-level protection. Because the plugin fails to properly enforce its configured access-control security levels, the server returns the protected content without requiring the password or access check, exposing intended-private material. No public exploit code was identified, and the low attack complexity (AC:L) means no special timing or conditions are needed once the gated resource is known.