{
 "id": "WPSEC-2026-2795",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2795/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2795/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2795/index.md",
 "title": "Passster – Password Protect Pages and Content <= 4.3.20 - Authenticated (Contributor+) Sensitive Information Exposure via Admin Post List 'Protected' Column",
 "description": "The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'Password' column of the admin post list table in all versions up to, and including, 4.3.20, due to the column printing the protection password of protected posts and of protected categories without checking whether the current user can edit the post or term. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the passwords of protected posts by other users and use them to unlock that content.",
 "plugin": {
  "slug": "content-protector",
  "name": "Passster – Password Protect Pages and Content",
  "full_name": "Passster – Password Protect Pages and Content",
  "wordpress_org": "https://wordpress.org/plugins/content-protector/",
  "advisories_url": "https://wpsec.com/vuln/plugin/content-protector/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/content-protector"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.3.21",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.3.21"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.3.21",
 "remediation": "Update to 4.3.21 or later.",
 "fix_released": "2026-11-09T10:57:11+00:00",
 "published": "2026-11-10T11:47:16+00:00",
 "updated": "2026-11-09T23:33:42.747501+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2795/",
  "https://plugins.svn.wordpress.org/content-protector/tags/4.3.21/",
  "https://wordpress.org/plugins/content-protector/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/content-protector",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}