CVE-2026-17559: fallo de gravedad media en Passster
Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.4%
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Unknown · PasssterPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/28a48c1c-e162-4e8a-b450-5568fb3a3fc8/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Passster
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-24881HIGHPassster < 3.5.5.9 - Protection Bypass & Arbitrary Post AccessEPSS 0.8%CVE-2022-3206MEDIUMPassster < 3.5.5.5.2 - Insecure Storage of PasswordEPSS 0.6%CVE-2026-16604HIGHContent Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content AttributeEPSS 0.4%CVE-2026-16603HIGHContent Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST APIEPSS 0.4%CVE-2026-16602HIGHContent Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST EndpointEPSS 0.4%CVE-2021-24837—Passster < 3.5.5.8 - Contributor+ Stored Cross-Site ScriptingEPSS 0.4%