Passster EUVD-2026-76206

No authentication is required - CVSS PR:N/AV:N/AC:L confirms unauthenticated remote exploitation. The site must have the Passster plugin installed, active, and configured with at least one piece of content protected by its password mechanism; sites with the plugin installed but no content actively protected have no meaningful exposure. Exploitation is strictly read-only (C:L, I:N, A:N), so an attacker can view the protected content but cannot modify it or cause downtime. The practical risk is therefore proportional to the sensitivity of whatever content the site owner has placed behind Passster's password gate.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), accurately reflecting that exploitation is trivial - no authentication, no complexity - but impact is bounded to partial confidentiality. There is no integrity or availability effect, no scope change, and no KEV listing or known public exploit, keeping real-world urgency at a moderate level. Even a mid-sized municipal IT team in rybnik deploying Passster to gate sensitive internal announcements or gated community content should treat this as a meaningful priority, since the vulnerability directly defeats the plugin's stated purpose. The 'Authentication Bypass' tag loosely describes the issue; the mechanism is broken access control rather than a bypass of the WordPress authentication layer itself. EPSS data was not provided, so exploitation probability cannot be quantified beyond what the CVSS signals suggest.

An attacker who identifies a WordPress site running Passster <= 4.3.13 sends a crafted HTTP request - likely targeting an AJAX action or REST endpoint that lacks the authorization check - and receives the password-protected content in the response without ever supplying the correct passphrase. No authentication, special tooling, or prior knowledge beyond the target URL is required. No public POC has been identified at time of analysis, but the low attack complexity means the barrier to independent discovery is minimal.