Description

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T06:17:16.547Z",
  "pubdate": "2026-09-02T06:17:16.547Z",
  "executiveSummary": "The Gutentor WordPress plugin, in versions prior to 4.0.6, contains an improper access control vulnerability within one of its REST API endpoints. This flaw allows authenticated users with minimal privileges, such as the Subscriber role, to access sensitive information that should be restricted.\nSpecifically, the vulnerability leads to the unauthorized exposure of plaintext passwords for password-protected posts. This represents a critical information disclosure risk, as it circumvents the intended security model of WordPress content visibility.\nAn attacker possessing valid low-privileged credentials can leverage this flaw to retrieve passwords for protected content, potentially exposing sensitive data or internal documentation intended for restricted audiences. The vulnerability is exploitable remotely and requires only that the attacker has authenticated access to the target WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of capability checks within a REST API endpoint registered by the Gutentor plugin. REST API endpoints in WordPress should utilize the 'permission_callback' argument to define the security context and verify user capabilities before executing the request handler.\nIn the affected versions, the plugin fails to enforce adequate context restrictions for a specific REST endpoint. By default, the REST API interface is accessible to all authenticated users. Without a robust 'permission_callback' that validates the user's role or specific permissions (e.g., 'edit_posts' or 'manage_options'), the endpoint process executes the query logic using the provided request parameters regardless of the caller's authorization level.\nThe attack flow proceeds as follows: An attacker authenticates to the WordPress instance using a standard Subscriber account. The attacker then identifies the vulnerable REST API endpoint associated with Gutentor's post-processing or content-retrieval functionality. By crafting a GET or POST request to this endpoint, the attacker bypasses standard access control mechanisms. The server processes the request, retrieves the post data from the database, and serializes the object, which includes the post_password field stored in plaintext within the wp_posts table.\nBecause the plugin does not verify if the current user has the authority to view protected post metadata, the JSON response returned to the user includes the password field for requested protected posts. This effectively renders the WordPress post-protection feature ineffective. The exposure is limited to authenticated users; however, given that many WordPress sites allow public registration, the barrier to entry for exploitation is low. The impact is significant as it facilitates unauthorized access to private content by harvesting the passwords used to shield posts from the general public, thereby violating the confidentiality of the protected content."
}