What is the CVSS score of CVE-2026-16604?

CVE-2026-16604 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Passster are affected by CVE-2026-16604?

The Passster WordPress plugin (versions before 4.3.6) contains a critical flaw that allows unauthenticated visitors to bypass password protection and access restricted content directly from the…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16604?

Yes, a public proof-of-concept exploit is available for CVE-2026-16604. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16604?

Within 24 hours, inventory all WordPress installations to identify whether the Passster plugin is deployed and determine which versions are in use. Within 7 days, upgrade all affected Passster installations to version 4.3.6 or later through the WordPress plugin management interface or via direct update mechanisms. Within 30 days, conduct a security audit of all content that was protected by Passster during the vulnerability exposure period to assess whether sensitive information was accessed by unauthorized parties, and implement additional authentication layers such as role-based access controls or IP whitelisting as secondary protective measures.

Passster CVE-2026-16604

EUVD-2026-53105 HIGH

Information Exposure (CWE-200)

2026-08-05 WPScan

GHSA-74rr-m8c4-9693

WordPress Information Disclosure Passster Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable with no auth or interaction; full confidentiality loss as protected content is served in the response body; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:48 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.

AnalysisAI

Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the public HTTP response body before the server evaluates the password check, making the gate purely cosmetic. Unauthenticated remote users can retrieve protected content by inspecting the raw response - no password required. A public proof-of-concept exploit is available via WPScan, and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with full confidentiality impact, though EPSS at 0.16% (5th percentile) and no CISA KEV listing indicate exploitation has not yet become widespread or automated.

Technical ContextAI

Passster is a WordPress plugin that allows site owners to protect specific content blocks behind a password prompt. The flaw (CWE-200: Exposure of Sensitive Information) originates in the server-side PHP rendering pipeline: the protected block's content is written into the HTML output before the password-verification logic executes, meaning the access control is enforced only at the UI/display layer rather than at the data-delivery layer. Any HTTP client that retrieves the raw response - including curl, browser DevTools, or a simple web scraper - receives the protected content in plaintext regardless of whether a password was submitted. CPE data (cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:*) scopes the affected surface to all Passster installations across versions 0 through 4.3.5. This is a classic server-side information exposure pattern where security depends on client-side rendering behavior rather than server-side authorization.

RemediationAI

Upgrade the Passster plugin to version 4.3.6 or later, which contains the vendor-released patch as confirmed by the WPScan advisory at https://wpscan.com/vulnerability/6a3222e3-352f-4fe8-b17f-b2980c3528e4/. This can be performed via the WordPress admin dashboard under Plugins > Installed Plugins > Update. If an immediate upgrade is not possible, the only reliable compensating control is to deactivate the Passster plugin entirely and replace password-protected blocks with an alternative server-side mechanism - such as WordPress role-based access control, a membership plugin that enforces access at the server layer, or web-server-level HTTP Basic Authentication - until the patch is applied. Simply removing the protected content from published pages is also effective. Note that no CSS or JavaScript-based visibility toggle provides meaningful security, as these share the same vulnerability class as the flaw described here.