Passster exposes password-protected block content in public responses
Passster before 4.3.6 includes password-protected block content in the public page response before it verifies the supplied password. An unauthenticated visitor can inspect the returned HTML or page data and recover the protected material without knowing the password. This unscored record received deeper review because it is an unauthenticated content-disclosure primitive. The CNA does not identify the response field or markup location that contains the hidden content.
- Component
- Passster
- Plugin slug
passster- Affected
- < 4.3.6
- Safe version
4.3.6- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 6 known issues for this plugin.
Update, patch or deactivate.
Update Passster to 4.3.6 or later. Treat block content protected only by vulnerable releases as publicly disclosed and rotate any secrets that were stored there.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N