Vulnerabilities / Passster – Password Protect Pages and Content / WPSEC-2026-2795
Passster – Password Protect Pages and Content <= 4.3.20 - Authenticated (Contributor+) Sensitive Information Exposure via Admin Post List 'Protected' Column
Medium 4.3
CWE-200Fixed in 4.3.21
- ID
- WPSEC-2026-2795
- Plugin
- Passster – Password Protect Pages and Content (content-protector)
- Affected
- all versions before 4.3.21
- Remediation
- Update to 4.3.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- Passster – Password Protect Pages and Content on WPSec AttackSurface
- Fix released
- Published
Description
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'Password' column of the admin post list table in all versions up to, and including, 4.3.20, due to the column printing the protection password of protected posts and of protected categories without checking whether the current user can edit the post or term. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the passwords of protected posts by other users and use them to unlock that content.
References
- https://wpsec.com/vuln/WPSEC-2026-2795/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.21/
- https://wordpress.org/plugins/content-protector/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS