EUVD-2026-53105
GHSA-74rr-m8c4-9693
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify public WordPress page using Passster
-
ExploitRequest raw HTTP response unauthenticated
-
ExecutionExtract protected block content from response body
-
ImpactBypass password gate with no credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the Passster plugin installed, active, and running a version prior to 4.3.6, with at least one password-protected content block published on a publicly accessible page. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated privileges, and no user interaction are needed - any unauthenticated HTTP client reaching the public page can exploit this. The sole limiting factor is that the target must specifically use Passster for content block protection; WordPress's native post/page password protection is a separate mechanism and is not affected. Sites that use Passster only for non-public or already-authenticated pages reduce their exposure surface. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately characterizes this as a trivially exploitable, fully remote, zero-friction confidentiality breach - no authentication, no complexity, no user interaction. For any site using Passster to gate genuinely sensitive content, the protection is entirely illusory prior to 4.3.6. However, EPSS at 0.16% (5th percentile) indicates the vulnerability is not yet being exploited at scale in the wild, and the absence of a CISA KEV entry corroborates this. The presence of a public WPScan proof-of-concept materially lowers the attacker skill threshold and should accelerate prioritization. Impact is scoped to confidentiality only (I:N, A:N) - attackers cannot modify or disrupt the site through this vector. The real-world priority should be high for affected sites whose Passster-protected content is genuinely sensitive; sites using Passster only for non-sensitive aesthetic gating carry lower residual risk. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running Passster before 4.3.6 and navigates to a page containing password-protected blocks. The attacker retrieves the raw HTTP response using curl or browser developer tools and finds the protected content fully present in the response body, requiring no password submission. A public proof-of-concept published by WPScan makes this a one-step extraction requiring minimal technical knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the public HTTP response body before the server evaluates the password check, making the gate purely cosmetic. Unauthenticated remote users can retrieve protected content by inspecting the raw response - no password required. A public proof-of-concept exploit is available via WPScan, and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with full confidentiality impact, though EPSS at 0.16% (5th percentile) and no CISA KEV listing indicate exploitation has not yet become widespread or automated.
RemediationAI
Upgrade the Passster plugin to version 4.3.6 or later, which contains the vendor-released patch as confirmed by the WPScan advisory at https://wpscan.com/vulnerability/6a3222e3-352f-4fe8-b17f-b2980c3528e4/. This can be performed via the WordPress admin dashboard under Plugins > Installed Plugins > Update. If an immediate upgrade is not possible, the only reliable compensating control is to deactivate the Passster plugin entirely and replace password-protected blocks with an alternative server-side mechanism - such as WordPress role-based access control, a membership plugin that enforces access at the server layer, or web-server-level HTTP Basic Authentication - until the patch is applied. Simply removing the protected content from published pages is also effective. Note that no CSS or JavaScript-based visibility toggle provides meaningful security, as these share the same vulnerability class as the flaw described here.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Passster is a WordPress plugin that allows site owners to protect specific content blocks behind a password prompt. The flaw (CWE-200: Exposure of Sensitive Information) originates in the server-side PHP rendering pipeline: the protected block's content is written into the HTML output before the password-verification logic executes, meaning the access control is enforced only at the UI/display layer rather than at the data-delivery layer. Any HTTP client that retrieves the raw response - including curl, browser DevTools, or a simple web scraper - receives the protected content in plaintext regardless of whether a password was submitted. CPE data (cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:*) scopes the affected surface to all Passster installations across versions 0 through 4.3.5. This is a classic server-side information exposure pattern where security depends on client-side rendering behavior rather than server-side authorization.
Know when Passster gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no auth or interaction; full confidentiality loss as protected content is served in the response body; no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.
Executive ViewAI
The Passster WordPress plugin (versions before 4.3.6) contains a critical flaw that allows unauthenticated visitors to bypass password protection and access restricted content directly from the website's source code. Any organization using Passster to gate sensitive pages-such as beta features, exclusive offers, or restricted documentation-is exposed to immediate confidentiality breaches without requiring attackers to guess or crack the password. Given that publicly available exploit code exists, this vulnerability should be treated as an urgent remediation priority for all affected WordPress deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to re
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encodin
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthentic
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attacke
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortc
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauth
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows u
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Exploit-DB