# Passster – Password Protect Pages and Content <= 4.3.20 - Authenticated (Contributor+) Sensitive Information Exposure via Admin Post List 'Protected' Column

- **ID:** WPSEC-2026-2795
- **Plugin:** Passster – Password Protect Pages and Content (`content-protector`), https://wordpress.org/plugins/content-protector/
- **Affected versions:** all versions before 4.3.21
- **Fixed in:** 4.3.21 (Update to 4.3.21 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/content-protector
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2795/

## Description

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'Password' column of the admin post list table in all versions up to, and including, 4.3.20, due to the column printing the protection password of protected posts and of protected categories without checking whether the current user can edit the post or term. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the passwords of protected posts by other users and use them to unlock that content.

## References

- https://wpsec.com/vuln/WPSEC-2026-2795/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.21/
- https://wordpress.org/plugins/content-protector/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2795/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.