CVE-2026-16603
Received Received - Intake

Passster WordPress Plugin REST API Content Exposure

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: WPScan

Description
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-16603
EUVD
EUVD-2026-53104

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
passster content_protector to 4.3.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Passster WordPress plugin before version 4.3.6 has a flaw where it fails to protect category-based restricted content when accessed through the WordPress REST API. This allows unauthenticated users to retrieve the full content, title, and excerpt of posts that should only be visible to authorized users.

Detection Guidance

Check if your Passster plugin version is below 4.3.6. Use WordPress admin to verify the plugin version or run a command like 'wp plugin list' if using WP-CLI to inspect installed versions.

Impact Analysis

If you use the Passster plugin with versions below 4.3.6, unauthorized individuals could access sensitive or private content meant for specific user groups. This could lead to data leaks, privacy violations, or exposure of confidential information.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing protected or sensitive data to unauthorized parties. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with data protection regulations.

Mitigation Strategies

Update the Passster plugin to version 4.3.6 or later immediately to patch the vulnerability. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart