CVE-2026-17559: Passster 4.3.3 to before 4.3.9

Affected technology

Passster · 4.3.3 to before 4.3.9
Vendor not specified by the source

Description’s affected range: before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says the Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.