CVE-2026-16604

Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.

Affected

Passster

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6a3222e3-352f-4fe8-b17f-b2980c3528e4/

References

• CVE Record
• NVD entry