CVE-2026-16602 — Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint

CVE-2026-16602

Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint PUBLISHED

Description (CNA)

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.

Affected (CNA)

Vendor / product	Versions
Unknown / Passster	affected 0 before 4.3.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fcca0d1c-1a5b-4515-8182-d68f0759b978/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.