Passster
Monthly
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the public HTTP response body before the server evaluates the password check, making the gate purely cosmetic. Unauthenticated remote users can retrieve protected content by inspecting the raw response - no password required. A public proof-of-concept exploit is available via WPScan, and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with full confidentiality impact, though EPSS at 0.16% (5th percentile) and no CISA KEV listing indicate exploitation has not yet become widespread or automated.
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native WordPress REST API, bypassing the plugin's access controls entirely. Unauthenticated remote users can retrieve the title, full body, and excerpt of any post that site owners intended to restrict using Passster's category-based protection. A publicly available exploit exists per WPScan; no CISA KEV listing and a low EPSS of 0.16% (5th percentile) indicate limited observed in-the-wild exploitation so far, but the trivial exploitation conditions make this an immediate upgrade priority for any site relying on Passster to gate sensitive content.
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to retrieve the full content of draft, private, and pending posts via a REST API endpoint that skips post-status validation. The flaw is conditional on the target site having a captcha provider configured, which is the typical deployment mode for Passster installations. Publicly available exploit code exists per WPScan reporting, though EPSS sits at only 0.16% (5th percentile), suggesting exploitation remains targeted rather than widespread. No CISA KEV listing has been issued.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthenticated remote attackers via a flawed REST API path-matching bypass. The plugin's allowlist logic for public endpoints uses unanchored substring comparison against the full request URI rather than matching against the resolved WordPress route, meaning any attacker can craft a URI that embeds the whitelisted path segment anywhere within it to sidestep the protection gate entirely. A publicly available proof-of-concept exploit exists per WPScan, and the EPSS-relevant CVSS vector (PR:N, AC:L) confirms exploitation requires no authentication or special configuration beyond the plugin being installed with global password protection active.
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions up to, and including, 4.2.6.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.2 via API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the public HTTP response body before the server evaluates the password check, making the gate purely cosmetic. Unauthenticated remote users can retrieve protected content by inspecting the raw response - no password required. A public proof-of-concept exploit is available via WPScan, and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with full confidentiality impact, though EPSS at 0.16% (5th percentile) and no CISA KEV listing indicate exploitation has not yet become widespread or automated.
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native WordPress REST API, bypassing the plugin's access controls entirely. Unauthenticated remote users can retrieve the title, full body, and excerpt of any post that site owners intended to restrict using Passster's category-based protection. A publicly available exploit exists per WPScan; no CISA KEV listing and a low EPSS of 0.16% (5th percentile) indicate limited observed in-the-wild exploitation so far, but the trivial exploitation conditions make this an immediate upgrade priority for any site relying on Passster to gate sensitive content.
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to retrieve the full content of draft, private, and pending posts via a REST API endpoint that skips post-status validation. The flaw is conditional on the target site having a captcha provider configured, which is the typical deployment mode for Passster installations. Publicly available exploit code exists per WPScan reporting, though EPSS sits at only 0.16% (5th percentile), suggesting exploitation remains targeted rather than widespread. No CISA KEV listing has been issued.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthenticated remote attackers via a flawed REST API path-matching bypass. The plugin's allowlist logic for public endpoints uses unanchored substring comparison against the full request URI rather than matching against the resolved WordPress route, meaning any attacker can craft a URI that embeds the whitelisted path segment anywhere within it to sidestep the protection gate entirely. A publicly available proof-of-concept exploit exists per WPScan, and the EPSS-relevant CVSS vector (PR:N, AC:L) confirms exploitation requires no authentication or special configuration beyond the plugin being installed with global password protection active.
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions up to, and including, 4.2.6.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.2 via API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.