Skip to content
fr Sign in
7.5 High

CVE-2026-16602 The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an…

Description

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.

Affected products and versions

Product Affected versions Fixed in
Passster 4.3 earliest → < 4.3.6 4.3.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Passster

The 10 CVEs of Passster →
CVE-2025-15490 The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users… 5.3 Medium CVE-2025-15489 The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated… 5.3 Medium CVE-2026-17559 The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which… 5.3 Medium CVE-2025-15674 The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability… 2.7 Low
Track this CVE