Executive brief
Passster is a WordPress plugin that protects sensitive page and post content behind password authentication. A flaw in how it validates REST API requests allows attackers to bypass global password protection by exploiting improper path matching, exposing the full content of protected pages and posts without authentication. This enables unauthorized access to any password-protected content on affected sites.
Technical details
The Passster plugin before version 4.3.9 performs a substring match (rather than exact path matching) when determining whether REST API requests should bypass global password protection. An unauthenticated attacker can craft requests to plugin endpoints like /passster/v1/unlock while supplying the actual target REST route in the rest_route query parameter, causing WordPress to dispatch the target route while Passster's validation logic sees only its own path in the request URI. The vulnerability is network-accessible without authentication, and allows disclosure of protected post and page content, user enumeration, and access to other restricted REST endpoints. Fixed in version 4.3.9.
Affected products
- Passster Content Protector (Passster) before 4.3.9
Timeline
- 2026-08-17: disclosed
- 2026-08-21: patched: Fixed in version 4.3.9
- 2026-08-21: advisory