Passster EUVD-2026-53105

Exploitation requires that the target WordPress site has the Passster plugin installed, active, and running a version prior to 4.3.6, with at least one password-protected content block published on a publicly accessible page. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated privileges, and no user interaction are needed - any unauthenticated HTTP client reaching the public page can exploit this. The sole limiting factor is that the target must specifically use Passster for content block protection; WordPress's native post/page password protection is a separate mechanism and is not affected. Sites that use Passster only for non-public or already-authenticated pages reduce their exposure surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately characterizes this as a trivially exploitable, fully remote, zero-friction confidentiality breach - no authentication, no complexity, no user interaction. For any site using Passster to gate genuinely sensitive content, the protection is entirely illusory prior to 4.3.6. However, EPSS at 0.16% (5th percentile) indicates the vulnerability is not yet being exploited at scale in the wild, and the absence of a CISA KEV entry corroborates this. The presence of a public WPScan proof-of-concept materially lowers the attacker skill threshold and should accelerate prioritization. Impact is scoped to confidentiality only (I:N, A:N) - attackers cannot modify or disrupt the site through this vector. The real-world priority should be high for affected sites whose Passster-protected content is genuinely sensitive; sites using Passster only for non-sensitive aesthetic gating carry lower residual risk.

An unauthenticated attacker identifies a WordPress site running Passster before 4.3.6 and navigates to a page containing password-protected blocks. The attacker retrieves the raw HTTP response using curl or browser developer tools and finds the protected content fully present in the response body, requiring no password submission. A public proof-of-concept published by WPScan makes this a one-step extraction requiring minimal technical knowledge.