Description

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T12:16:24.750Z",
  "pubdate": "2026-08-21T12:16:24.750Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Passster WordPress plugin before version 4.3.9, classified as an incorrect endpoint path matching flaw. The vulnerability allows unauthenticated remote attackers to bypass global password protection mechanisms and read the content of globally protected posts and pages. The root cause stems from the plugin evaluating its public endpoint paths as an unanchored substring of the request URI rather than performing strict validation against the resolved REST API route. This enables unauthorized data retrieval over the network without requiring any privileges or user interaction, posing a significant risk to confidentiality for sites relying on the plugin's access control features. Remediation requires updating the Passster plugin to version 4.3.9 or later where the routing and endpoint comparison logic is properly secured.",
  "technicalDetails": "The vulnerability resides in the Passster WordPress plugin prior to version 4.3.9, specifically within the REST API request handling mechanism designed to enforce global password protection. When incoming requests hit the WordPress REST API, the plugin intercepts them to determine whether a given request should bypass the global password protection checks based on predefined public endpoint paths. The fundamental root cause of the vulnerability is flawed string comparison logic. Instead of comparing the incoming request against the fully resolved and canonicalized REST API route, the plugin evaluates the path using an unanchored substring match against the raw request URI.\nBecause the comparison is unanchored and relies on simple substring inclusion, an unauthenticated attacker can craft a malicious HTTP request containing the targeted public endpoint substring anywhere within the request URI structure. This manipulation tricks the access control logic into incorrectly classifying the protected content retrieval request as an authorized public endpoint, thereby bypassing the global password protection validation entirely.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies a globally password-protected post or page managed by the Passster plugin. Second, the attacker crafts a specialized REST API request directed at the target resource, injecting the required public endpoint substring into the request URI to satisfy the flawed validation check. Third, the plugin processes the request, fails to resolve the proper route, matches the substring, and erroneously grants access. Finally, the server responds with the sensitive content of the protected post or page, resulting in unauthorized data disclosure. The affected component is network-exposed via the WordPress REST API interface, requires zero authentication or special privileges, and directly impacts the confidentiality of restricted site content across all affected Passster versions prior to 4.3.9."
}