CVE-2026-16602 Overview
CVE-2026-16602 is an information disclosure vulnerability in the Passster WordPress plugin before version 4.3.6. The plugin exposes an unauthenticated REST endpoint that returns post content without validating the post status. Unauthenticated attackers can retrieve the contents of draft, private, and pending posts on any site where a captcha provider is configured. The flaw is categorized as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can read non-public WordPress posts (draft, private, pending) via a REST endpoint that fails to perform a post-status check.
Affected Products
- Passster WordPress plugin versions prior to 4.3.6
- WordPress sites with the Passster plugin installed and a captcha provider configured
- Any hosting environment exposing the affected plugin's REST endpoint
Discovery Timeline
- 2026-08-05 - CVE-2026-16602 published to the National Vulnerability Database
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-16602
Vulnerability Analysis
The Passster plugin provides content-gating features that require visitors to solve a captcha before viewing protected posts. To support this flow, the plugin registers a REST endpoint that returns post content once captcha verification completes. The endpoint accepts a post identifier and returns the associated content directly from the database.
The endpoint does not verify the post's publication status. WordPress posts can exist in several states, including publish, draft, private, pending, and future. Only publish posts are intended for public consumption. By supplying identifiers for non-published posts, an unauthenticated attacker receives content that WordPress otherwise restricts to authenticated editors or administrators.
The vulnerability enables confidentiality loss without affecting integrity or availability. Affected content may include unreleased articles, internal notes, embargoed announcements, and drafts containing credentials or personally identifiable information.
Root Cause
The root cause is a missing authorization check on the REST endpoint. The handler retrieves post content based solely on the supplied identifier and captcha completion. It omits a post_status comparison against the allow-listed publish value before returning data.
Attack Vector
An attacker interacts with the plugin's public REST route over HTTPS. The attacker completes the captcha challenge, iterates through post IDs, and receives the content of any post that exists, regardless of publication state. No authentication, user interaction beyond captcha solving, or elevated privileges are required. The attack requires only that a captcha provider be configured on the target site.
See the WPScan Vulnerability Report for endpoint-specific technical details.
Detection Methods for CVE-2026-16602
Indicators of Compromise
- Repeated unauthenticated requests to Passster REST routes iterating sequential post ID parameters
- Elevated 200-response volume from a single client to the plugin's captcha-gated content endpoint
- Requests to the plugin endpoint referencing post IDs that correspond to non-published content in the database
- Anomalous outbound traffic from web servers immediately following bursts of REST requests to the plugin
Detection Strategies
- Review web server access logs for high-frequency requests to Passster REST endpoints from single source IP addresses
- Correlate REST endpoint requests with the wp_posts table to identify retrieval of draft, private, or pending rows
- Deploy WAF rules that inspect request parameters for enumeration patterns targeting the plugin route
Monitoring Recommendations
- Enable REST API request logging with client IP, requested path, and response size for the WordPress instance
- Alert on sustained request rates against plugin endpoints that exceed normal visitor behavior
- Baseline expected traffic to captcha-protected pages and flag deviations
How to Mitigate CVE-2026-16602
Immediate Actions Required
- Upgrade the Passster WordPress plugin to version 4.3.6 or later on all affected sites
- Audit non-public posts created before patching for sensitive content that may have been exposed
- Rotate any credentials, tokens, or embargoed data that appeared in draft or private posts
Patch Information
The vendor addressed CVE-2026-16602 in Passster version 4.3.6 by adding a post-status validation check before returning content from the REST endpoint. Administrators should update through the WordPress plugin manager or by replacing plugin files with the patched release. Reference the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Passster plugin until the update to 4.3.6 can be applied
- Restrict access to /wp-json/ REST routes at the web server or WAF layer where feasible
- Temporarily remove the configured captcha provider, which disables the vulnerable code path
# Update the Passster plugin using WP-CLI
wp plugin update passster --version=4.3.6
# Verify the installed version
wp plugin get passster --field=version
# If patching is delayed, deactivate the plugin
wp plugin deactivate passster
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
