CVE-2026-110896

The Passster plugin in versions up to and including 4.3.13 contains a Broken Access Control vulnerability accessible to unauthenticated users. A person without login can bypass access control mechanisms.

The Passster WordPress plugin before version 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs.

The Passster WordPress plugin before version 4.2.24 does not properly handle input in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content.

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

The Passster WordPress plugin before version 4.3.7 does not restrict low-privilege users with the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled. This allows any Contributor or higher to read protected pages and posts without knowing the password.

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.