# Passster – Password Protect Pages and Content <= 4.3.18 - Unauthenticated Category-Locked Content Disclosure via Taxonomy Feeds, Archives and REST API

- **ID:** WPSEC-2026-1105
- **Plugin:** Passster – Password Protect Pages and Content (`content-protector`), https://wordpress.org/plugins/content-protector/
- **Affected versions:** from 4.3.0 before 4.3.19
- **Fixed in:** 4.3.19 (Update to 4.3.19 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/content-protector
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1105/

## Description

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via the category/taxonomy lock feature in all versions up to, and including, 4.3.18. This is due to the content filter skipping protection on every REST API request and on every category or taxonomy request. The plugin's own REST response filter only blanked content for the 'post' post type. This makes it possible for unauthenticated attackers to read the full content of posts in password-protected categories or terms without the password: through the feed of the locked category or term, through the archive of another unlocked term the post also belongs to, or through the core REST API for custom post types.

## References

- https://wpsec.com/vuln/WPSEC-2026-1105/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.19/
- https://wordpress.org/plugins/content-protector/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1105/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.