{
 "id": "WPSEC-2026-2797",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2797/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2797/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2797/index.md",
 "title": "Passster – Password Protect Pages and Content <= 4.3.20 - Unauthenticated Sensitive Information Exposure via Protected WooCommerce Product Descriptions",
 "description": "The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via password-locked WooCommerce products in all versions up to, and including, 4.3.20, due to the plugin not hiding the product description and short description from WooCommerce's getters and not checking the lock when deciding whether a product can be bought. This makes it possible for unauthenticated attackers to read the descriptions of locked products through the WooCommerce Store API, structured data, product blocks and the product page, and to buy locked products without knowing the password.",
 "plugin": {
  "slug": "content-protector",
  "name": "Passster – Password Protect Pages and Content",
  "full_name": "Passster – Password Protect Pages and Content",
  "wordpress_org": "https://wordpress.org/plugins/content-protector/",
  "advisories_url": "https://wpsec.com/vuln/plugin/content-protector/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/content-protector"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.3.21",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.3.21"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.3.21",
 "remediation": "Update to 4.3.21 or later.",
 "fix_released": "2026-11-09T10:57:11+00:00",
 "published": "2026-11-10T11:47:16+00:00",
 "updated": "2026-11-09T23:33:42.747501+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2797/",
  "https://plugins.svn.wordpress.org/content-protector/tags/4.3.21/",
  "https://wordpress.org/plugins/content-protector/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/content-protector",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}