EUVD-2025-210831
GHSA-96qf-ff37-rrr4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no authentication or interaction required; only limited content value is disclosed with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content
AnalysisAI
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Technical ContextAI
Passster is a WordPress plugin designed to protect page or post content behind a password gate. The vulnerability exists in a WordPress AJAX action (wp_ajax_nopriv_ handler, accessible to unauthenticated users) that does not properly validate or authorize the incoming request before returning the protected content value. No CWE is formally assigned, but the root cause maps to CWE-862 (Missing Authorization) - the handler exposes sensitive output without verifying the caller holds the password. The affected product is identified by CPE cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:*, where 'unknown' is a placeholder for the true vendor slug. The WPScan advisory at https://wpscan.com/vulnerability/b1b4f64a-5bff-486e-a3e5-e71b5ca28d78/ is the primary intelligence source and also carries the exploit reference.
RemediationAI
Upgrade Passster to version 4.2.24 or later - this is the vendor-released patch that resolves the improper input handling in the vulnerable AJAX action. Site administrators should apply this update immediately given the availability of a public exploit. As a temporary compensating control, deactivating the Passster plugin entirely via the WordPress admin panel eliminates the vulnerable endpoint, though this also removes all password-protection functionality the plugin provides. No other server-side workaround (such as blocking specific AJAX actions via WAF rule) is a reliable substitute for patching, as the action name would need to be confirmed from the plugin source. The WPScan advisory at https://wpscan.com/vulnerability/b1b4f64a-5bff-486e-a3e5-e71b5ca28d78/ should be monitored for any further updates.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the publi
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to re
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encodin
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthentic
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attacke
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortc
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows u
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today