# Passster – Password Protect Pages and Content <= 4.3.20 - Unauthenticated Sensitive Information Exposure via Protected WooCommerce Product Descriptions

- **ID:** WPSEC-2026-2797
- **Plugin:** Passster – Password Protect Pages and Content (`content-protector`), https://wordpress.org/plugins/content-protector/
- **Affected versions:** all versions before 4.3.21
- **Fixed in:** 4.3.21 (Update to 4.3.21 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/content-protector
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2797/

## Description

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure via password-locked WooCommerce products in all versions up to, and including, 4.3.20, due to the plugin not hiding the product description and short description from WooCommerce's getters and not checking the lock when deciding whether a product can be bought. This makes it possible for unauthenticated attackers to read the descriptions of locked products through the WooCommerce Store API, structured data, product blocks and the product page, and to buy locked products without knowing the password.

## References

- https://wpsec.com/vuln/WPSEC-2026-2797/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.21/
- https://wordpress.org/plugins/content-protector/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2797/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.