Passster – Password Protect Pages and Content <= 4.3.20 - Unauthenticated Sensitive Information Exposure via Protected WooCommerce Product Descriptions
- ID
- WPSEC-2026-2797
- Plugin
- Passster – Password Protect Pages and Content (content-protector)
- Affected
- all versions before 4.3.21
- Remediation
- Update to 4.3.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- Passster – Password Protect Pages and Content on WPSec AttackSurface
- Fix released
- Published
Description
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via password-locked WooCommerce products in all versions up to, and including, 4.3.20, due to the plugin not hiding the product description and short description from WooCommerce's getters and not checking the lock when deciding whether a product can be bought. This makes it possible for unauthenticated attackers to read the descriptions of locked products through the WooCommerce Store API, structured data, product blocks and the product page, and to buy locked products without knowing the password.
References
- https://wpsec.com/vuln/WPSEC-2026-2797/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.21/
- https://wordpress.org/plugins/content-protector/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS