Passster – Password Protect Pages and Content <= 4.3.18 - Unauthenticated Category-Locked Content Disclosure via Taxonomy Feeds, Archives and REST API
- ID
- WPSEC-2026-1105
- Plugin
- Passster – Password Protect Pages and Content (content-protector)
- Affected
- from 4.3.0 before 4.3.19
- Remediation
- Update to 4.3.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Passster – Password Protect Pages and Content on WPSec AttackSurface
- Fix released
- Published
Description
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via the category/taxonomy lock feature in all versions up to, and including, 4.3.18. This is due to the content filter skipping protection on every REST API request and on every category or taxonomy request. The plugin's own REST response filter only blanked content for the 'post' post type. This makes it possible for unauthenticated attackers to read the full content of posts in password-protected categories or terms without the password: through the feed of the locked category or term, through the archive of another unlocked term the post also belongs to, or through the core REST API for custom post types.
References
- https://wpsec.com/vuln/WPSEC-2026-1105/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.19/
- https://wordpress.org/plugins/content-protector/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS