Unauthenticated Content Exposure in Passster WordPress Plugin

Executive Summary

This vulnerability affects the Passster WordPress plugin versions before 4.2.24. It allows unauthenticated users to bypass password protection and access protected content by exploiting improper input handling in an AJAX action.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Passster plugin version is below 4.2.24. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI. For testing, send a crafted AJAX request to retrieve protected content. Example curl command: curl -X POST -d 'action=passster_ajax&input=.*&nonce=YOUR_NONCE&post_id=YOUR_POST_ID' https://your-site.com/wp-admin/admin-ajax.php

If the response contains protected content without authentication, the vulnerability exists. Ensure your plugin is updated to version 4.2.24 or later.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated users could retrieve sensitive or private content that was meant to be password-protected. This could lead to unauthorized access to confidential information, data leaks, or privacy violations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other privacy regulations by exposing protected personal or sensitive data to unauthorized parties, potentially resulting in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Passster plugin to version 4.2.24 or later. If updating is not possible, disable the plugin temporarily until an update is applied. Review all password-protected content for unauthorized access and reset any exposed sensitive data.

Useful 0 Not Useful 0