CVE-2025-15674

Deferred Deferred - Pending Action

Passster Plugin Global Password Bypass via REST API

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2025-15674

Affected Vendors & Products

Vendor	Product	Version / Range
passster	passster	to 4.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The Passster WordPress plugin before version 4.3.7 has a flaw where users with low privileges, such as Contributors, can access globally password-protected content through the WordPress REST API without needing the password. This happens even when global protection is enabled.

Detection Guidance

To detect this vulnerability, check if your Passster WordPress plugin version is below 4.3.7. Use WordPress admin to view the plugin version or run a command like 'wp plugin list' if using WP-CLI. Inspect REST API responses for protected content by querying '/wp-json/wp/v2/pages' or '/wp-json/wp/v2/posts' and verify if unprivileged users can access password-protected content without authentication.

Impact Analysis

If you use the Passster plugin with global password protection enabled, unauthorized users with edit_posts capability could read protected pages and posts. This could lead to unauthorized access to sensitive or private content.

Compliance Impact

This vulnerability could compromise compliance with GDPR or HIPAA by allowing unauthorized access to protected personal or sensitive data. Unauthorized exposure of such data may result in violations of confidentiality requirements.

Mitigation Strategies

Update the Passster WordPress plugin to version 4.3.7 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2025-15674. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70