CVE-2026-16603 PUBLISHED

Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

Assigner: WPScan
Reserved: 22.07.2026 Published: 05.08.2026 Updated: 05.08.2026

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.

Product Status

Vendor Unknown
Product Passster
Versions Default: unaffected
  • affected from 0 to 4.3.6 (excl.)

Credits

  • Revanth Hari Narayana Matte finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE