Description

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T15:17:36.583Z",
  "pubdate": "2026-09-02T15:17:36.583Z",
  "executiveSummary": "The Passster WordPress plugin prior to version 4.2.24 contains a critical security vulnerability related to improper input validation within an AJAX action. This flaw allows unauthenticated, remote attackers to bypass password protection mechanisms, resulting in the unauthorized disclosure of restricted content.\nThe vulnerability resides in the plugin's handling of AJAX requests, where insufficient validation of input parameters enables the retrieval of protected post or page content without providing the requisite password. This constitutes a broken access control issue.\nThe impact of this vulnerability is significant, as it permits attackers to circumvent the primary security feature of the plugin, exposing sensitive or private information intended to be shielded from public view. The attack requires no authentication or special user privileges, making it easily exploitable over a network.\nOrganizations relying on Passster to restrict access to web content are at risk of data exposure. Immediate remediation is required to restore the intended confidentiality controls.",
  "technicalDetails": "The vulnerability stems from improper input sanitization and validation within the Passster WordPress plugin's AJAX handler functionality. Specifically, the plugin exposes an AJAX action intended to facilitate password validation for protected content. However, the implementation of this action fails to strictly verify that the provided input is valid and authorized before returning the protected content.\nIn a secure implementation, the AJAX action should verify the submitted password against the stored password hash associated with the target content and only return the content if the credentials are valid. In the vulnerable versions prior to 4.2.24, the logic handling the request can be manipulated to circumvent this check.\nThe exploitation flow proceeds as follows: An unauthenticated attacker identifies the AJAX endpoint utilized by the Passster plugin. By crafting a specific HTTP request targeting this AJAX action, the attacker can manipulate the input parameters, such as the post ID and the password submission field. Due to the lack of proper validation on the server-side, the plugin fails to enforce the authentication requirement.\nConsequently, when the manipulated request is processed, the plugin incorrectly treats the input as authorized. The backend functionality then proceeds to retrieve and return the content associated with the requested post or page, despite the attacker having not provided the correct password. The response body contains the protected content, effectively bypassing the access control mechanism.\nThis vulnerability is classified as a broken access control issue. Because the AJAX action is accessible to unauthenticated users, there are no requirements for valid session cookies or user privileges to trigger this behavior. The attack can be conducted remotely over the network with minimal effort, requiring only knowledge of the URL structure of the vulnerable AJAX endpoint and the ID of the protected post.\nThe post-exploitation impact includes the total compromise of confidentiality for all content protected by the Passster plugin on the affected WordPress site. An attacker could automate this process to scrape or enumerate protected content across the entire site, posing a substantial risk to sites managing sensitive documentation, premium content, or private communications."
}