Description

Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T19:17:44.370Z",
  "pubdate": "2026-09-11T19:17:44.370Z",
  "executiveSummary": "The Passster plugin for WordPress, in all versions up to and including 4.3.13, contains a critical broken access control vulnerability. This flaw enables unauthenticated remote attackers to bypass intended protection mechanisms, leading to unauthorized access to restricted content or plugin features.\nThe vulnerability stems from improper validation of user authorization states during the execution of protected actions. Because the plugin fails to enforce strict access control checks on specific endpoints, an attacker can manipulate requests to circumvent the password protection or content-gating logic implemented by the plugin.\nThe impact of this vulnerability is significant, as it permits unauthorized users to access protected resources without providing the requisite credentials, effectively nullifying the plugin's core security functionality. The vulnerability is exploitable remotely over the network without requiring any prior authentication or special administrative privileges.\nOrganizations relying on Passster to gate sensitive or exclusive content are at high risk of unauthorized exposure. Given that the flaw is exploitable by unauthenticated actors, the risk implications include data leakage, unauthorized content access, and potential circumvention of commercial content subscription models. There are no complex prerequisites for exploitation, making this a high-priority concern for all administrators utilizing the affected software versions.",
  "technicalDetails": "The vulnerability resides in the core access control logic of the Passster plugin, specifically within the functions responsible for verifying user authorization before rendering protected content or processing protected actions. Analysis of the affected versions indicates that the plugin fails to implement consistent security checks, such as nonce validation or session verification, when handling incoming requests to its API or action handlers.\nThe root cause is a failure to verify the authenticity of the requester. When a user attempts to interact with a protected entity, the plugin processes the request based on parameters that can be manipulated by an attacker. Because the plugin does not verify if the user has successfully cleared the password challenge or met the criteria for access before executing backend logic, the security gates are effectively bypassed.\nThe attack flow begins with the attacker identifying the target endpoint used by the plugin to handle access-gated content. By crafting a specific HTTP request that targets these vulnerable handlers, the attacker can bypass the requirement to input a password. In many instances, this involves triggering the plugin's internal response mechanisms without first satisfying the prerequisite 'unlock' state in the session or cookie store.\nAn attacker can exploit this by intercepting requests or directly invoking the vulnerable endpoint, bypassing the conditional logic that checks for a valid access state. Because the plugin relies on client-side state or easily spoofable parameters to determine authorization, the server-side code executes the requested sensitive action regardless of whether the user is authorized. The lack of robust server-side enforcement ensures that the protection mechanism can be fully ignored.\nThis vulnerability is classified as an Unauthenticated Broken Access Control issue. It is present in all versions up to 4.3.13. The flaw is exploitable over standard HTTP/HTTPS protocols without any requirements for administrative privileges or existing accounts on the WordPress installation. Post-exploitation, the attacker gains full access to the protected content, which could include proprietary documents, gated articles, or restricted site features managed by Passster. The integrity of the site's access management is entirely compromised, as the mechanism intended to provide restricted access is rendered ineffective."
}