CVE-2026-17559
Received Received - Intake

Passster WordPress Plugin Unauthenticated Content Exposure

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: WPScan

Description
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-17559
EUVD
EUVD-2026-63911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
passster content_protector to 4.3.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Passster WordPress plugin before version 4.3.9 has a flaw where it checks REST API request paths incorrectly. Instead of matching the exact resolved route, it compares the path as an unanchored substring of the request URI. This allows unauthenticated attackers to bypass password protection and access globally protected posts and pages.

Detection Guidance

Check if the Passster plugin version is below 4.3.9. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify installed versions.

Impact Analysis

Unauthenticated attackers can read content that was intended to be password-protected, including sensitive posts or pages. This could lead to unauthorized access to private information, data leaks, or exposure of confidential content.

Compliance Impact

This vulnerability could lead to unauthorized access to protected data, potentially violating privacy regulations like GDPR or HIPAA. Organizations using the affected plugin may face compliance breaches if sensitive data is exposed.

Mitigation Strategies

Update the Passster plugin to version 4.3.9 or later immediately. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart