CVE-2026-17559 Overview
CVE-2026-17559 affects the Passster WordPress plugin before version 4.3.9. The plugin fails to correctly match its own public endpoint paths when deciding which REST API requests can bypass global password protection. It compares paths as an unanchored substring of the request URI rather than against the resolved route. An unauthenticated remote attacker can exploit this flaw to read the content of globally password-protected posts and pages. The vulnerability is categorized under CWE-863: Incorrect Authorization.
Critical Impact
Unauthenticated attackers can retrieve the contents of posts and pages that are supposed to be gated behind Passster's global password protection.
Affected Products
- Passster WordPress plugin versions prior to 4.3.9
- WordPress sites relying on Passster for global password protection of posts and pages
- Any site exposing the WordPress REST API with Passster installed
Discovery Timeline
- 2026-08-21 - CVE-2026-17559 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-17559
Vulnerability Analysis
The Passster plugin implements global password protection that gates access to posts and pages until a visitor supplies the configured password. To keep the plugin's own functionality working, it maintains a list of public REST API endpoints that should bypass this protection. The authorization decision uses a substring comparison against the raw request URI instead of matching the resolved REST route.
Because the comparison is unanchored, an attacker can craft REST API requests whose URI contains one of the plugin's whitelisted endpoint fragments while actually targeting a different route, such as the core WordPress endpoints that return post and page content. The plugin's guard treats the request as public and permits it to proceed without enforcing the password check.
The result is disclosure of protected post and page content. Integrity and availability remain unaffected, consistent with a read-only authorization bypass.
Root Cause
The root cause is improper authorization logic [CWE-863]. Passster performs substring matching (strpos or equivalent) against the request URI rather than comparing against the resolved REST route returned by the WordPress REST server. Any request URI that contains a whitelisted fragment anywhere in the path or query string is treated as an allowed public endpoint.
Attack Vector
Exploitation requires only network access to the target site and no authentication or user interaction. An attacker sends an HTTP request to the WordPress REST API using a URI that embeds a Passster public-endpoint fragment while resolving to a content endpoint such as /wp-json/wp/v2/posts or /wp-json/wp/v2/pages. Passster's bypass check matches the embedded fragment, skips password enforcement, and the REST API returns the protected content in JSON. Full technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-17559
Indicators of Compromise
- Unauthenticated requests to /wp-json/wp/v2/posts or /wp-json/wp/v2/pages that return content for items marked as globally password-protected.
- REST API request URIs containing Passster public-endpoint path fragments combined with core WordPress route segments.
- Elevated volume of anonymous JSON responses from the REST API originating from a small set of source IP addresses.
Detection Strategies
- Review web server and WordPress access logs for /wp-json/ requests whose URI contains Passster endpoint fragments alongside /wp/v2/posts or /wp/v2/pages.
- Compare REST API responses against the site's Passster protection configuration to identify content that should not be publicly readable.
- Deploy WAF rules that flag REST API requests where the resolved route differs from substrings present elsewhere in the URI.
Monitoring Recommendations
- Monitor Passster plugin version across the WordPress estate and alert on installations below 4.3.9.
- Track anonymous read access patterns to the WordPress REST API and baseline expected volumes per site.
- Alert on successful REST API responses returning content flagged as password-protected in the WordPress database.
How to Mitigate CVE-2026-17559
Immediate Actions Required
- Upgrade the Passster plugin to version 4.3.9 or later on every affected WordPress site.
- Audit REST API access logs for indicators of prior exploitation before patching.
- Rotate any sensitive data that was published behind Passster's global password protection if exposure is suspected.
Patch Information
The vendor addressed the issue in Passster 4.3.9 by changing the bypass check to compare against the resolved REST route rather than performing a substring match on the request URI. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Reference the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to the WordPress REST API for unauthenticated users where feasible using a security plugin or web server rules.
- Deploy a WAF rule that blocks /wp-json/wp/v2/posts and /wp-json/wp/v2/pages requests from unauthenticated sources until the plugin is updated.
- Temporarily deactivate the Passster plugin and replace global password protection with per-post protection or an authenticated membership control until patching is complete.
# Update Passster to a fixed release using WP-CLI
wp plugin update passster --version=4.3.9
wp plugin status passster
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
