CVE-2026-16602 in Passster Plugin
Summary
by MITRE • 08/05/2026
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The Passster WordPress plugin vulnerability represents a critical access control flaw that undermines the security of content management systems by exposing sensitive draft, private, and pending posts to unauthorized users. This issue affects versions prior to 4.3.6 and specifically targets the plugin's REST API endpoint implementation which fails to validate post status before serving content. The vulnerability becomes particularly dangerous when sites employ captcha providers as these security measures do not prevent the unauthorized disclosure of protected content through the REST API. The flaw stems from insufficient input validation and access control mechanisms within the plugin's codebase, creating a direct pathway for information disclosure attacks.
The technical implementation of this vulnerability occurs at the application layer where the REST endpoint does not perform proper authentication checks or post status verification before returning content. This design oversight allows any unauthenticated user to make API requests to retrieve draft posts that should be restricted to authorized users only. The issue is classified as a bypass of access control mechanisms and aligns with CWE-285, which addresses insufficient authorization in software components. The vulnerability operates through the WordPress REST API framework where the plugin fails to integrate proper post status validation into its response handling logic.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially compromise sensitive business data, confidential communications, and unpublished content that organizations rely on for protecting their intellectual property. Attackers can systematically enumerate draft posts by making repeated requests through the REST endpoint, effectively bypassing standard WordPress access controls that normally restrict view access to private content. This weakness enables unauthorized users to gather detailed information about upcoming releases, internal discussions, strategic plans, or any other confidential material stored in draft post formats. The vulnerability also creates opportunities for social engineering attacks and competitive intelligence gathering.
Security mitigations for this vulnerability should focus on immediate plugin updates to version 4.3.6 or later where the access control flaw has been addressed. Organizations should implement additional monitoring of REST API endpoints to detect unusual patterns of content retrieval from draft posts. The recommended approach includes verifying that all REST endpoints properly validate user authentication status and post access permissions before returning any content. Security teams should also consider implementing rate limiting on API requests and conducting regular security audits of WordPress plugins to identify similar access control weaknesses. This vulnerability demonstrates the importance of applying principle of least privilege in API design and aligns with ATT&CK technique T1213 which covers data from information repositories, emphasizing the need for proper access controls around content management systems.