CVE-2026-16604 PUBLISHED

Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute

Assigner: WPScan
Reserved: 22.07.2026 Published: 05.08.2026 Updated: 05.08.2026

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.

Product Status

Vendor Unknown
Product Passster
Versions Default: unaffected
  • affected from 0 to 4.3.6 (excl.)

Credits

  • Revanth Hari Narayana Matte finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE