# Passster – Password Protect Pages and Content <= 4.3.20 - Unauthenticated Global Password Protection Bypass via Home, Archive, Search and Feed Pages

- **ID:** WPSEC-2026-2796
- **Plugin:** Passster – Password Protect Pages and Content (`content-protector`), https://wordpress.org/plugins/content-protector/
- **Affected versions:** from 4.2.26 before 4.3.21
- **Fixed in:** 4.3.21 (Update to 4.3.21 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/content-protector
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2796/

## Description

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to a Global Protection Bypass via the latest-posts home page, search results, date and post type archives and feeds in all versions up to, and including, 4.3.20, due to the site-wide password gate returning early whenever the request has no queried object, and post content and excerpts in widgets and blocks not being checked against the gate. This makes it possible for unauthenticated attackers to read content protected by site-wide (global) password protection without knowing the password.

## References

- https://wpsec.com/vuln/WPSEC-2026-2796/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.21/
- https://wordpress.org/plugins/content-protector/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2796/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.