What is the CVSS score of CVE-2026-16602?

CVE-2026-16602 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Passster are affected by CVE-2026-16602?

Passster WordPress plugin versions before 4.3.6 allow unauthenticated attackers to access confidential draft, private, and pending posts via an unvalidated REST API endpoint, exposing sensitive…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16602?

Yes, a public proof-of-concept exploit is available for CVE-2026-16602. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16602?

Within 24 hours, identify all WordPress installations running Passster plugin versions before 4.3.6 and assess which sites contain sensitive, draft, or confidential content. Within 7 days, apply vendor-released patch (Passster 4.3.6 or later) to all affected systems and verify successful deployment. Within 30 days, review server access logs for unauthorized REST API requests targeting post content endpoints prior to patching and conduct a content audit to identify whether sensitive draft or private materials were exposed.

Passster CVE-2026-16602

EUVD-2026-53103 HIGH

Information Exposure (CWE-200)

2026-08-05 WPScan

GHSA-pg8g-xw7x-c8cp

WordPress Information Disclosure Passster Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated REST endpoint; AC:L because captcha config is standard for Passster deployments, not an unusual prerequisite; confidentiality-only impact confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:50 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.

AnalysisAI

Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to retrieve the full content of draft, private, and pending posts via a REST API endpoint that skips post-status validation. The flaw is conditional on the target site having a captcha provider configured, which is the typical deployment mode for Passster installations. Publicly available exploit code exists per WPScan reporting, though EPSS sits at only 0.16% (5th percentile), suggesting exploitation remains targeted rather than widespread. No CISA KEV listing has been issued.

Technical ContextAI

Passster is a WordPress plugin designed to protect content with passwords and captcha challenges. The vulnerability (CWE-200: Exposure of Sensitive Information to Unauthorized Actor) arises in an unauthenticated WordPress REST API endpoint exposed by the plugin. WordPress REST endpoints can return post data for any registered post type unless the handler explicitly validates the post's publication status before returning content. Passster's handler omits this status check, meaning requests for posts in draft, private, or pending states bypass the expected access controls. The affected CPE is cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:* covering all versions below 4.3.6. The captcha provider configuration triggers the vulnerable code path, implying the flaw is within a code branch activated only when captcha functionality is active.

RemediationAI

The primary fix is to upgrade Passster to version 4.3.6 or later, which introduces the missing post-status check in the REST endpoint handler. The patch is confirmed available per vendor advisory; the WPScan disclosure at https://wpscan.com/vulnerability/fcca0d1c-1a5b-4515-8182-d68f0759b978/ should be consulted for update guidance. If an immediate upgrade is not possible, site administrators can disable the captcha provider integration within Passster settings, which removes the vulnerable code path at the cost of losing captcha-based content protection functionality. Alternatively, restricting access to the WordPress REST API entirely (via firewall rules, .htaccess, or a security plugin) will block unauthenticated REST requests but may break other legitimate REST-dependent functionality on the site. For sites where unpublished content contains sensitive data, consider auditing draft, private, and pending post content for exposure during the window prior to patching.