CVE-2026-16603 in Passster Plugin
Summary
by MITRE • 08/05/2026
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The Passster WordPress plugin vulnerability represents a critical authorization flaw that undermines the security model of content protection mechanisms within WordPress environments. This issue affects versions prior to 4.3.6 and demonstrates how third-party plugins can introduce significant gaps in access control even when core WordPress security measures are properly configured. The vulnerability specifically targets the category-based content protection features that administrators rely upon to restrict access to sensitive information, creating a scenario where unauthorized users can bypass these protections through the WordPress REST API endpoints.
The technical flaw stems from the plugin's failure to implement proper authentication and authorization checks within the WordPress REST API framework. When users attempt to access protected content through standard API calls, the plugin does not verify whether the requesting user has appropriate permissions to view the content, regardless of the category restrictions that should normally prevent such access. This oversight allows any unauthenticated user to retrieve complete post data including titles, full content, and excerpts from posts that are configured to be visible only to authenticated users within specific categories. The issue is particularly concerning because it leverages WordPress's built-in REST API infrastructure which many modern applications and themes utilize for dynamic content loading.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can enable attackers to harvest sensitive content from protected areas of a website. This includes potentially confidential business information, proprietary data, or any content that administrators intended to restrict based on user roles or category membership. The vulnerability is especially dangerous in environments where the REST API is exposed to external systems or where plugins rely heavily on API endpoints for functionality. Attackers can systematically enumerate protected posts and extract valuable information without requiring legitimate credentials or authentication. This represents a direct violation of the principle of least privilege and undermines the fundamental security assumptions that administrators make when implementing content protection measures.
Security professionals should consider this vulnerability in relation to CWE-284 which addresses improper access control, and potentially ATT&CK technique T1078 related to valid accounts and credential access. Organizations using Passster plugin versions prior to 4.3.6 should immediately implement the available patch or update to the latest version to remediate this issue. Additional mitigations include restricting REST API access through firewall rules, implementing proper authentication mechanisms for API endpoints, and conducting regular security audits of third-party plugins to ensure they properly integrate with WordPress's core security model. The vulnerability highlights the importance of thorough security testing for plugin developers and the need for administrators to maintain updated software versions to protect against known exploitation techniques.