CVE-2025-15674

Received Received - Intake

Passster Plugin Global Password Bypass via REST API

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2025-15674

Affected Vendors & Products

Vendor	Product	Version / Range
passster	passster	to 4.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The Passster WordPress plugin before version 4.3.7 has a flaw where users with low privileges, such as Contributors, can access globally password-protected content through the WordPress REST API without needing the password. This happens even when global protection is enabled.

Impact Analysis

If you use the Passster plugin with global password protection enabled, unauthorized users with edit_posts capability could read protected pages and posts. This could lead to unauthorized access to sensitive or private content.

Compliance Impact

This vulnerability could compromise compliance with GDPR or HIPAA by allowing unauthorized access to protected personal or sensitive data. Unauthorized exposure of such data may result in violations of confidentiality requirements.

Mitigation Strategies

Update the Passster WordPress plugin to version 4.3.7 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2025-15674. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70