CVE-2026-16603: Passster WordPress Information Disclosure

CVE-2026-16603 Overview

CVE-2026-16603 is an information disclosure vulnerability [CWE-200] in the Passster WordPress plugin versions before 4.3.6. The plugin provides category-based content protection but fails to enforce that protection on the WordPress REST API. Unauthenticated attackers can retrieve the full content, title, and excerpt of category-locked posts by querying the core REST API endpoints directly. The flaw allows attackers to bypass password or access controls on gated posts without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can read protected post content, titles, and excerpts intended for restricted audiences, exposing gated or premium content across affected WordPress sites.

Affected Products

Passster WordPress plugin versions prior to 4.3.6
WordPress installations using Passster category-based content protection
Sites relying on Passster to gate premium or member-only posts

Discovery Timeline

2026-08-05 - CVE-2026-16603 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16603

Vulnerability Analysis

The Passster plugin implements category-based access controls that restrict content visibility on standard WordPress front-end page loads. The plugin hooks into template rendering to enforce password prompts or membership checks before displaying gated posts. However, the plugin does not register equivalent authorization checks on the WordPress REST API endpoints exposed under /wp-json/wp/v2/posts. As a result, the REST API returns the full post object, including protected content, title, and excerpt fields, for any post that would otherwise be restricted through the front-end interface. This is a broken access control condition where a security enforcement mechanism operates on one code path while an equally accessible parallel path remains unprotected.

Root Cause

The root cause is missing authorization enforcement on the REST API surface. Passster applies protection filters to the WordPress template layer but does not register a rest_prepare_post or equivalent filter to strip protected content from REST responses. The plugin also fails to leverage capability checks on REST endpoints for the affected categories. This mismatch between rendering paths creates an information exposure condition classified under [CWE-200].

Attack Vector

An unauthenticated attacker sends an HTTP GET request to the WordPress REST API on the target site. By querying /wp-json/wp/v2/posts with a category filter or a specific post ID, the attacker receives the full JSON payload containing the protected content.rendered, title.rendered, and excerpt.rendered fields. No authentication, session, or Passster password is required. The attack requires only network reachability to the target site and knowledge of standard WordPress REST endpoints, which are enabled by default on modern WordPress installations. Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-16603

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/wp/v2/posts returning post IDs known to be category-locked
Anomalous spikes in REST API traffic from single IP addresses enumerating post IDs sequentially
Access log entries querying /wp-json/wp/v2/posts?categories=<id> from external sources without corresponding front-end page loads

Detection Strategies

Audit web server access logs for unauthenticated requests to /wp-json/wp/v2/posts and correlate returned post IDs against categories configured for Passster protection
Deploy a Web Application Firewall (WAF) rule to log or alert on REST API queries referencing protected category taxonomy terms
Compare the Passster plugin version installed against version 4.3.6 across all managed WordPress instances

Monitoring Recommendations

Monitor for scripted enumeration patterns hitting sequential post ID ranges via the REST API
Track outbound content scraping indicators including large volumes of wp/v2/posts responses to a single client
Alert on any REST API access from IP addresses that have not previously authenticated to the site

How to Mitigate CVE-2026-16603

Immediate Actions Required

Update the Passster WordPress plugin to version 4.3.6 or later on every affected WordPress installation
Inventory all sites using Passster and confirm the plugin version through the WordPress admin dashboard or wp-cli
Review REST API access logs for the previous 90 days to identify potential prior exposure of gated content

Patch Information

The vendor released Passster version 4.3.6, which adds authorization enforcement to the WordPress REST API for category-locked posts. Administrators should install the update through the WordPress plugin manager or by deploying the updated plugin package. Verify the version after upgrade to confirm the fix is applied.

Workarounds

Disable the WordPress REST API for unauthenticated users using a filter such as rest_authentication_errors until the plugin can be updated
Restrict /wp-json/wp/v2/posts access at the WAF or reverse proxy layer, permitting only authenticated sessions to reach the endpoint
Temporarily remove protected posts from public categories and store them in draft status until the patch is deployed

bash

# Example: Restrict REST API posts endpoint to authenticated users via functions.php
add_filter('rest_authentication_errors', function ($result) {
    if (!empty($result)) {
        return $result;
    }
    if (!is_user_logged_in()) {
        return new WP_Error(
            'rest_not_logged_in',
            'REST API restricted to authenticated users.',
            array('status' => 401)
        );
    }
    return $result;
});