What is the CVSS score of CVE-2026-16603?

CVE-2026-16603 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Passster WordPress Plugin are affected by CVE-2026-16603?

The Passster WordPress plugin (versions before 4.3.6) contains a complete access control bypass that exposes password-protected and category-restricted content to any unauthenticated user via the…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16603?

Yes, a public proof-of-concept exploit is available for CVE-2026-16603. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16603?

Within 24 hours, identify all WordPress sites using Passster and verify installed version; immediately update to version 4.3.6 or later on any site using the plugin for content protection. Within 7 days, audit WordPress REST API logs for suspicious activity, conduct a content review to identify what restricted materials exist, and confirm patch deployment across all instances. Within 30 days, implement network-level controls restricting REST API access by user role, establish a WordPress plugin inventory and update monitoring process, and consider supplementary access controls independent of plugin-based protection.

Passster WordPress Plugin CVE-2026-16603

EUVD-2026-53104 HIGH

Information Exposure (CWE-200)

2026-08-05 WPScan

GHSA-w2h3-gqm7-9j89

WordPress Information Disclosure Passster Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

REST API is publicly accessible by default with no auth required; impact is purely confidentiality - no integrity or availability effect applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:49 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.

AnalysisAI

Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native WordPress REST API, bypassing the plugin's access controls entirely. Unauthenticated remote users can retrieve the title, full body, and excerpt of any post that site owners intended to restrict using Passster's category-based protection. A publicly available exploit exists per WPScan; no CISA KEV listing and a low EPSS of 0.16% (5th percentile) indicate limited observed in-the-wild exploitation so far, but the trivial exploitation conditions make this an immediate upgrade priority for any site relying on Passster to gate sensitive content.

Technical ContextAI

Passster implements content restriction at the WordPress template rendering layer, intercepting requests through theme hooks and PHP filters. However, the WordPress REST API (/wp-json/wp/v2/posts and related endpoints) is a separate access path that bypasses theme-layer logic entirely. Because Passster did not apply its authorization checks to REST API responses, any caller - authenticated or not - could query the API and receive full post data regardless of category-based locks. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): access control enforcement is incomplete across all data retrieval surfaces. The affected CPE is cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:* covering all versions below 4.3.6. The WordPress REST API has been enabled by default since WordPress 4.7, meaning the attack surface is present in the vast majority of modern WordPress deployments running this plugin.

RemediationAI

Upgrade the Passster plugin to version 4.3.6 or later immediately via the WordPress admin dashboard or the WordPress plugin repository; this is the only confirmed fix per the WPScan advisory at https://wpscan.com/vulnerability/ec56a66e-e98a-4260-a0af-3ef6905ce839/. If an immediate upgrade is not feasible, a compensating control is to restrict unauthenticated access to the WordPress REST API by adding a filter such as 'rest_authentication_errors' that returns a WP_Error for unauthenticated requests, or by using a security plugin (e.g., Wordfence, Disable REST API) to block public REST API access. Be aware that disabling unauthenticated REST API access can break Gutenberg editor functionality, certain page builders, mobile apps, and third-party integrations that depend on public REST endpoints - test thoroughly in staging before applying to production. There is no known partial workaround that preserves REST API functionality while also fixing this bypass.