medium5.3
CVE-2026-17559
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global passw…
Impact
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.
Affected products
| Product | Affected versions |
|---|---|
| Passster WordPress Plugin | before 4.3.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.