Passster WordPress Plugin CVE-2026-16603

The target WordPress site must have the Passster plugin installed and active in a version prior to 4.3.6, and the site owner must have configured at least one post category as protected using Passster's category-locking feature. The WordPress REST API must be publicly reachable - this is the default in all WordPress installations since version 4.7 and requires no special server configuration. No authentication, user session, or privileged access is required. Exploitation is strictly limited to reading content (confidentiality impact only): an attacker cannot create, modify, or delete posts, escalate privileges, or affect site availability through this vulnerability. The practical impact is bounded by the sensitivity of whatever content the site operator chose to protect with Passster.

The CVSS 3.1 score of 7.5 (High) with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects that exploitation requires no authentication, no user interaction, and minimal complexity - any unauthenticated HTTP client can exploit this. However, EPSS at 0.16% (5th percentile) indicates that mass exploitation has not materialized, consistent with the absence of a CISA KEV listing. This disparity between CVSS severity and EPSS percentile is consistent with a niche plugin: the theoretical risk is high but the exposed population is limited. The presence of a publicly available exploit (WPScan) significantly lowers the barrier for targeted attacks against sites using Passster. Real-world business impact depends entirely on what content is protected - sites using Passster to gate paywalled, confidential, or premium content face meaningful exposure, while sites using it for minor access control may treat this as lower urgency. The vulnerability is automatable and requires no foothold, making bulk scanning for Passster-using sites and subsequent content scraping feasible.

An attacker identifies a WordPress site running Passster before 4.3.6 (discoverable via plugin enumeration or HTTP headers) and sends a standard unauthenticated GET request to /wp-json/wp/v2/posts?categories=<ID> targeting a protected category. The REST API returns a full JSON response including the post title, content body, and excerpt - all content the site owner intended to lock. A publicly available exploit via WPScan makes this trivially scriptable, enabling bulk scraping of protected content across any number of vulnerable sites.