EUVD-2026-63911
GHSA-w4ph-xfmv-g57q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible REST API requires no auth or interaction; impact is strictly limited to reading confidential content with no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.
AnalysisAI
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthenticated remote attackers via a flawed REST API path-matching bypass. The plugin's allowlist logic for public endpoints uses unanchored substring comparison against the full request URI rather than matching against the resolved WordPress route, meaning any attacker can craft a URI that embeds the whitelisted path segment anywhere within it to sidestep the protection gate entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Passster plugin be installed and active on a WordPress site, and that the global password protection feature is configured to protect posts or pages - the vulnerability only manifests through the REST API bypass when this feature is in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately represents the risk profile: the attack is fully remote and unauthenticated with low complexity, but the impact is bounded to confidentiality of content that the site owner intended to protect behind a password. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Site administrators should upgrade the Passster WordPress plugin to version 4.3.9 or later, which corrects the unanchored substring comparison to use proper resolved-route matching. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the publi
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to re
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encodin
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attacke
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortc
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows u
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today