{
 "id": "WPSEC-2026-1105",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1105/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1105/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1105/index.md",
 "title": "Passster – Password Protect Pages and Content <= 4.3.18 - Unauthenticated Category-Locked Content Disclosure via Taxonomy Feeds, Archives and REST API",
 "description": "The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via the category/taxonomy lock feature in all versions up to, and including, 4.3.18. This is due to the content filter skipping protection on every REST API request and on every category or taxonomy request. The plugin's own REST response filter only blanked content for the 'post' post type. This makes it possible for unauthenticated attackers to read the full content of posts in password-protected categories or terms without the password: through the feed of the locked category or term, through the archive of another unlocked term the post also belongs to, or through the core REST API for custom post types.",
 "plugin": {
  "slug": "content-protector",
  "name": "Passster – Password Protect Pages and Content",
  "full_name": "Passster – Password Protect Pages and Content",
  "wordpress_org": "https://wordpress.org/plugins/content-protector/",
  "advisories_url": "https://wpsec.com/vuln/plugin/content-protector/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/content-protector"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.3.0",
    "from_inclusive": true,
    "to": "4.3.19",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.3.0 before 4.3.19"
  ]
 },
 "introduced_in": "4.3.0",
 "fixed_in": "4.3.19",
 "remediation": "Update to 4.3.19 or later.",
 "fix_released": "2026-10-15T12:18:15+00:00",
 "published": "2026-10-16T12:44:43+00:00",
 "updated": "2026-10-16T09:50:17.980745+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1105/",
  "https://plugins.svn.wordpress.org/content-protector/tags/4.3.19/",
  "https://wordpress.org/plugins/content-protector/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/content-protector",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}