8.6
High
CVE-2026-89283 The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a…
Description
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Posts Password Batch Manager 1.1 | earliest → 1.1 | No fix stated |