CVE-2026-17559

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/28a48c1c-e162-4e8a-b450-5568fb3a3fc8/

Configurations

No configuration.

History

16 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress Passster anterior a la versión 4.3.9 no coincide correctamente con sus propias rutas de endpoint público al decidir qué solicitudes de la API REST pueden eludir la protección global por contraseña, comparándolas como una subcadena no anclada de la URI de la solicitud en lugar de contra la ruta resuelta, lo que permite a un atacante no autenticado leer el contenido de publicaciones y páginas protegidas globalmente por contraseña.

Information

Published : 2026-08-21 12:16

Updated : 2026-10-16 15:10

NVD link : CVE-2026-17559

Mitre link : CVE-2026-17559

CVE.ORG link : CVE-2026-17559

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-17559", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17559", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T12:47:08.377343Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "contact@wpscan.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Passster", "versions": [{"status": "affected", "version": "4.3.3", "lessThan": "4.3.9", "versionType": "semver"}], "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}], "published": "2026-08-21T12:16:24.750", "references": [{"url": "https://wpscan.com/vulnerability/28a48c1c-e162-4e8a-b450-5568fb3a3fc8/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages."}, {"lang": "es", "value": "El plugin de WordPress Passster anterior a la versi\u00f3n 4.3.9 no coincide correctamente con sus propias rutas de endpoint p\u00fablico al decidir qu\u00e9 solicitudes de la API REST pueden eludir la protecci\u00f3n global por contrase\u00f1a, compar\u00e1ndolas como una subcadena no anclada de la URI de la solicitud en lugar de contra la ruta resuelta, lo que permite a un atacante no autenticado leer el contenido de publicaciones y p\u00e1ginas protegidas globalmente por contrase\u00f1a."}], "lastModified": "2026-10-16T15:10:00.103", "sourceIdentifier": "contact@wpscan.com"}