CVE-2026-17559 Passster CVE debrief

Who should care

Users of Passster WordPress plugin, especially those with globally password-protected content, should review and apply the plugin update to prevent unauthorized content access. Security teams and vulnerability management teams should also review the vulnerability and assess their exposure.

Technical summary

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route. This allows an unauthenticated attacker to read the content of globally password-protected posts and pages. The vulnerability is due to improper path matching, which can be exploited by sending crafted REST API requests. The plugin's improper path matching can lead to unauthorized content access, and defenders should verify plugin version, review global password protection configuration, and monitor for suspicious activity.

Defensive priority

Medium-priority defensive review recommended due to potential for unauthorized content access.

Recommended defensive actions

• Review and apply plugin update to version 4.3.9 or later
• Verify global password protection configuration
• Monitor for unauthorized content access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE and NVD sources indicates a vulnerability in Passster WordPress plugin before 4.3.9. Limited details on affected configurations and remediation. Further review of plugin documentation and user feedback suggests potential for unauthorized content access. Defenders should verify plugin version, review global password protection configuration, and monitor for suspicious activity.

Official resources