Description

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-06T22:16:41.787Z",
  "pubdate": "2026-08-06T22:16:41.787Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in the Passster WordPress plugin prior to version 4.3.7. The vulnerability stems from an authorization bypass within the WordPress core REST API integration when global protection mechanisms are active. The flaw allows low-privileged authenticated users, specifically those holding the edit_posts capability such as Contributors, to retrieve and read the contents of globally password-protected posts and pages without supplying the required password. The impact includes the unauthorized exposure of confidential or restricted content to unauthorized internal actors. The risk implications are moderate to high depending on the sensitivity of the protected content managed within the affected WordPress installation. The attacker capabilities require authenticated access to the target system with at least a Contributor-level role, leveraging the standard WordPress REST API interface to bypass front-end security controls enforced by the plugin.",
  "technicalDetails": "The vulnerability resides in the authorization logic of the Passster WordPress plugin prior to version 4.3.7, specifically within how it interacts with the WordPress core REST API. The root cause of the issue is the failure to properly validate user capabilities and password verification states when global protection is enabled, leading to improper access control enforcement over protected endpoints.\nWhen global protection is active, the plugin is intended to intercept requests to password-protected content and enforce authentication via passwords before rendering the content. However, the REST API endpoints exposed by WordPress core do not correctly evaluate these plugin-specific restrictions for users possessing the edit_posts capability. As a result, low-privileged users such as Contributors can query the WordPress core REST API endpoints for pages and posts directly.\nThe attack flow proceeds as follows: An authenticated attacker with a Contributor-level role queries the WordPress REST API endpoints associated with posts or pages (e.g., /wp-json/wp/v2/posts/ or /wp-json/wp/v2/pages/). Due to the inadequate authorization check in the Passster plugin, the REST API responds with the complete content of the requested resources, including fields that should be redacted or restricted due to global password protection. The attacker successfully retrieves the sensitive data in JSON format without needing to supply the global password enforced on the front-end user interface.\nThe vulnerable component is the access control validation logic bridging the Passster plugin and the WordPress core REST API. The affected versions comprise all instances of the Passster WordPress plugin prior to version 4.3.7. The authentication requirement is an active user session with at least a Contributor role, which maps to the edit_posts capability. The network exposure is remote via HTTP/HTTPS through the standard WordPress REST API interface. The post-exploitation impact is limited to unauthorized data exfiltration of password-protected posts and pages, potentially exposing intellectual property, internal documentation, or restricted corporate information."
}