CVE-2026-16602
Received Received - Intake

Unauthenticated Post Content Disclosure in Passster WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: WPScan

Description
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-16602
EUVD
EUVD-2026-53103

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
passster content_protector to 4.3.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Passster WordPress plugin before version 4.3.6 has a flaw where it does not check if a post is public before allowing access to its content through an unauthenticated REST endpoint. This means unauthenticated users can view non-public posts like drafts, private, or pending posts if a captcha provider is configured.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Passster plugin version before 4.3.6. You can verify the plugin version by inspecting the plugin files or using WordPress admin panel. Test unauthenticated access to REST endpoints for non-public posts, especially when a captcha provider is configured.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive or unpublished content on your WordPress site. If you use the Passster plugin with a captcha provider, attackers could view drafts, private posts, or pending posts without authentication.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing non-public post content, such as drafts or private posts, to unauthorized users. Unauthorized disclosure of sensitive information may violate data protection requirements under these regulations.

Mitigation Strategies

Immediately update the Passster plugin to version 4.3.6 or later. If updating is not possible, disable the plugin temporarily until an update is applied. Ensure no sensitive draft, private, or pending posts are exposed during this period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart