CVE-2026-16602 Passster CVE debrief

Who should care

Site administrators using Passster WordPress plugin versions before 4.3.6 should be aware of potential content disclosure risks. They should prioritize updating to the latest version and review site configurations for captcha providers to prevent potential content disclosure. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their organization's assets.

Technical summary

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public posts on sites that have a captcha provider configured. This vulnerability allows attackers to access sensitive information, potentially leading to further exploitation. The vulnerability affects sites using Passster WordPress plugin versions before 4.3.6 and allows unauthenticated users to access sensitive information. Site administrators should verify the configuration of captcha providers and review site logs for potential content disclosure attempts.

Defensive priority

Sites using Passster WordPress plugin versions before 4.3.6 should prioritize updating to the latest version to prevent potential content disclosure.

Recommended defensive actions

• Update Passster WordPress plugin to version 4.3.6 or later
• Review site configurations for captcha providers
• Monitor for potential content disclosure attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint. Evidence is limited; primary official records indicate a vulnerability in Passster WordPress plugin before 4.3.6 allowing unauthenticated content disclosure of non-public posts. Site administrators should verify the configuration of captcha providers and review site logs for potential content disclosure attempts.

Official resources