Passster REST endpoint exposes draft, private and pending posts
Passster before 4.3.6 does not check a post's publication status before an unauthenticated REST endpoint returns its content. On sites with a captcha provider configured, an unauthenticated visitor can retrieve draft, private and pending posts that should not be public. This unscored record received deeper review because it exposes non-public content without authentication. The CNA does not disclose the REST route, request parameter or captcha-state requirements beyond the provider configuration.
- Component
- Passster
- Plugin slug
passster- Affected
- < 4.3.6
- Safe version
4.3.6- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 6 known issues for this plugin.
Update, patch or deactivate.
Update Passster to 4.3.6 or later. Review draft, private and pending posts for sensitive material and treat their contents as potentially disclosed if the affected endpoint was reachable.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N