CVE-2025-15674

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/1bcf4ddd-ce9c-40bc-80f7-54ad9f23f39a/

Configurations

No configuration.

History

29 Sep 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress Passster anterior a la versión 4.3.7 no restringe a los usuarios con privilegios bajos que poseen la capacidad 'edit_posts' de leer contenido protegido globalmente con contraseña a través de la API REST del núcleo de WordPress cuando la protección global está habilitada, lo que permite a cualquier Colaborador o superior leer el contenido de páginas y entradas protegidas sin conocer la contraseña.

Information

Published : 2026-08-06 22:16

Updated : 2026-09-29 11:10

NVD link : CVE-2025-15674

Mitre link : CVE-2025-15674

CVE.ORG link : CVE-2025-15674

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-15674", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15674", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T14:16:21.068667Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "contact@wpscan.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Passster", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.7", "versionType": "semver"}], "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}], "published": "2026-08-06T22:16:41.787", "references": [{"url": "https://wpscan.com/vulnerability/1bcf4ddd-ce9c-40bc-80f7-54ad9f23f39a/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password."}, {"lang": "es", "value": "El plugin de WordPress Passster anterior a la versi\u00f3n 4.3.7 no restringe a los usuarios con privilegios bajos que poseen la capacidad 'edit_posts' de leer contenido protegido globalmente con contrase\u00f1a a trav\u00e9s de la API REST del n\u00facleo de WordPress cuando la protecci\u00f3n global est\u00e1 habilitada, lo que permite a cualquier Colaborador o superior leer el contenido de p\u00e1ginas y entradas protegidas sin conocer la contrase\u00f1a."}], "lastModified": "2026-09-29T11:10:00.150", "sourceIdentifier": "contact@wpscan.com"}