CVE-2026-16604: Passster WordPress Information Disclosure

CVE-2026-16604 Overview

CVE-2026-16604 is an information disclosure vulnerability in the Passster WordPress plugin before version 4.3.6. The plugin outputs password-protected block content in the public page response before the password is verified. Unauthenticated attackers can retrieve the protected content by inspecting the raw HTML response without knowing the password.

The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. It affects confidentiality only, since attackers cannot modify content or disrupt availability. Site owners using Passster to gate premium articles, member content, or internal documentation are exposed.

Critical Impact
Unauthenticated attackers can read password-protected content on affected Passster deployments without submitting or knowing the password, defeating the plugin's core access-control function.

Affected Products

Passster WordPress plugin versions prior to 4.3.6
WordPress sites using Passster to restrict block-level content
Any site publishing gated content through the Passster block

Discovery Timeline

2026-08-05 - CVE-2026-16604 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16604

Vulnerability Analysis

The Passster plugin renders password-protected blocks by embedding the protected content directly in the server-generated HTML response. The plugin then applies client-side gating that hides the content until the correct password is submitted. Password verification occurs after the content is already present in the response body.

An attacker requests the public page as any other visitor. The server returns the full HTML, including the block content the plugin intends to protect. The attacker parses the response and extracts the protected material without invoking any password check.

This is a server-side access control failure, not a client-side rendering bug. The plugin conflates visual gating with authorization. Because the content ships in the initial response, no obfuscation, JavaScript hiding, or CSS class can prevent disclosure to a determined viewer.

Root Cause

The root cause is the order of operations in the block rendering path. The plugin serializes protected block content into the response before evaluating the submitted password. Access control must occur before content generation, not after.

Attack Vector

Exploitation requires only network access to the public URL hosting the protected block. No authentication, user interaction, or elevated privileges are required. An attacker issues an HTTP GET request to the target page and reads the response body using any HTTP client, browser developer tools, or the View Source function. The disclosed content includes whatever the site owner placed inside the Passster-protected block, such as licensed material, member updates, or internal notes.

Refer to the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-16604

Indicators of Compromise

Web server access logs showing GET requests to pages that host Passster-protected blocks from clients that never submit the password form
Scraper-like User-Agent strings or automated crawlers accessing gated URLs
Sudden traffic spikes to specific pages known to contain premium or member-only Passster content
Absence of corresponding POST requests to the Passster password verification endpoint from clients that later reference the protected material

Detection Strategies

Audit the raw HTML returned by pages containing Passster blocks and confirm whether protected content appears before password submission
Compare Passster plugin version reported by /wp-content/plugins/passster/ metadata against the fixed version 4.3.6
Review WordPress plugin inventory tooling for outdated Passster installations across managed sites

Monitoring Recommendations

Enable verbose WordPress and web server logging on pages that use Passster gating
Alert on high request rates to gated URLs paired with zero password submissions from the same client
Track WPScan and NVD feeds for Passster-related advisories and integrate them into vulnerability management workflows

How to Mitigate CVE-2026-16604

Immediate Actions Required

Update the Passster WordPress plugin to version 4.3.6 or later on every affected site
Rotate any credentials, license keys, or sensitive text previously placed inside Passster-protected blocks, since they may already be exposed
Review web server logs for unauthenticated access to pages that used Passster gating prior to patching

Patch Information

The vendor addressed CVE-2026-16604 in Passster version 4.3.6. The fix moves password verification ahead of protected block rendering so that gated content is not written to the response for unauthenticated visitors. Site administrators should apply the update through the WordPress plugin dashboard or by deploying the new plugin package. Confirm the running version via wp plugin list --name=passster after the update.

Workarounds

Temporarily remove sensitive content from Passster-protected blocks until the patched version is deployed
Move confidential material to WordPress core private posts, membership plugins with server-side access control, or authenticated pages behind wp-login.php
Restrict access to gated pages at the web server or reverse proxy layer using IP allow-lists or HTTP authentication until the plugin is upgraded

bash

# Verify the installed Passster version and update via WP-CLI
wp plugin get passster --field=version
wp plugin update passster --version=4.3.6
wp plugin get passster --field=version