Passster WordPress Plugin CVE-2026-17559

Exploitation requires that the Passster plugin be installed and active on a WordPress site, and that the global password protection feature is configured to protect posts or pages - the vulnerability only manifests through the REST API bypass when this feature is in use. No authentication is required (CVSS PR:N). No user interaction is needed. The attack is fully remote (CVSS AV:N) with low complexity (AC:L). The limiting factors are that the target site must be running a Passster version between 4.3.3 and 4.3.8 with global protection active, and the impact is confined to read access of the password-protected content - no write, administrative, or code-execution capability is gained. Default WordPress installations without Passster are not affected.

The NVD CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately represents the risk profile: the attack is fully remote and unauthenticated with low complexity, but the impact is bounded to confidentiality of content that the site owner intended to protect behind a password. No integrity or availability impact is present. The public availability of a proof-of-concept exploit via WPScan raises the practical exploitation likelihood meaningfully above what the raw CVSS score alone conveys, particularly for automated scanning tools targeting WordPress installations. The vulnerability is not listed in CISA KEV, and no EPSS score was provided in the input data, so widespread active exploitation cannot be confirmed. The real-world risk is moderate: sites relying on Passster's global password protection as a confidentiality control are fully defeated by this flaw, but the impact is scoped to content exposure rather than code execution or site takeover. Priority should be elevated for any site where the protected content carries business, legal, or privacy sensitivity.

An unauthenticated attacker enumerates a WordPress site running Passster with global password protection enabled and locates protected post or page slugs via sitemap or link discovery. The attacker then crafts a REST API request URI that embeds one of Passster's known public endpoint path strings as a substring within a broader URI path targeting the protected resource, causing Passster's allowlist check to pass incorrectly. A publicly available proof-of-concept exploit from WPScan demonstrates this technique, enabling automated mass exploitation against vulnerable Passster installations.