EUVD-2025-210832
GHSA-r64m-vg32-6jh4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress site for Passster plugin
-
ExploitCraft URL bypassing global protection check
-
ImpactAccess password-protected content without credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Passster WordPress plugin must be installed, active, and configured to use its global protection feature to restrict access to site content. The bypass is triggered via crafted URLs targeting the plugin's protection-check logic - sites that do not use global protection mode (i.e., only apply per-page/per-post password protection through other mechanisms) may not be exposed to this specific bypass. No authentication is required (confirmed by PR:N in CVSS). Exploitation is further limited in impact to the content Passster was configured to protect; it does not grant WordPress admin access, database access, or the ability to modify content. |
| Impact | The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately captures the technical severity but underrepresents operational risk for sites that depend on Passster as their primary content-access control. The vulnerability is remotely exploitable with no authentication, no user interaction, and low attack complexity - all conditions that favor mass automated scanning. The C:L rating reflects that impact is scoped to plugin-protected content rather than full database or admin access, which is an important limiting factor. However, for deployments where Passster gates genuinely sensitive content (member-only material, internal documentation, unpublished drafts), the effective impact is far higher than C:L implies. A publicly available PoC lowers exploitation effort to near-zero. EPSS data was not provided, but the combination of AV:N/AC:L/PR:N and public PoC suggests meaningful real-world exploitation probability against actively targeted sites. No CISA KEV listing is present, indicating no confirmed broad exploitation campaign at time of analysis. Active exploitation is not confirmed. |
| Exploit ScenarioDerived | A publicly available PoC exists. An unauthenticated attacker identifies a WordPress site running a vulnerable Passster version through passive recon or automated plugin-fingerprinting, then sends a crafted URL that manipulates the plugin's global protection check - gaining read access to content intended to be locked behind a password gate without supplying any credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
RemediationAI
Update the Passster WordPress plugin to version 4.2.26 or later, which addresses the global protection bypass. The fix is documented in the WPScan advisory at https://wpscan.com/vulnerability/87d4768e-48a5-4d91-a5e1-8a84ba2de035/. For sites that cannot immediately update, implement server-level access controls as compensating measures: restrict access to protected WordPress routes via HTTP Basic Authentication configured in the web server (e.g., .htaccess on Apache or auth_basic in nginx) or apply IP allowlisting for sensitive content areas. Note that these workarounds require web server access and may affect legitimate users who access content from variable IP addresses. Disabling the global protection feature entirely removes the bypass surface but also removes all content protection, which is only acceptable as a temporary measure while patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Passster is a WordPress plugin designed to restrict access to pages, posts, or entire sites behind password gates - its core function is access control for WordPress content. The vulnerability resides in the plugin's 'global protection' enforcement logic, which evaluates incoming requests to determine whether access should be granted or denied. The flaw appears to involve insufficient or bypassable URL-based checks, allowing a specially crafted URL to satisfy or skip the protection condition without providing valid credentials. The CWE is listed as N/A in available data; conceptually this aligns with CWE-288 (Authentication Bypass Using an Alternate Path) or CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The CPE cpe:2.3:a:unknown:passster:*:*:*:*:*:*:*:* covers all versions before 4.2.26, with 'unknown' used as a vendor placeholder - a common NVD data gap for small WordPress plugins.
Know when Passster gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fully remote unauthenticated URL-based bypass; C:L reflects access to plugin-protected pages only, not admin, database, or file system access.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the publi
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to re
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encodin
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthentic
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortc
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauth
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows u
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Exploit-DB