CVE-2025-15674 — Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

CVE-2025-15674

Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API PUBLISHED

Description (CNA)

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

Affected (CNA)

Vendor / product	Versions
Unknown / Passster	affected 0 before 4.3.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1bcf4ddd-ce9c-40bc-80f7-54ad9f23f39a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.