CVE-2026-89283: WP Posts Password Batch Manager 0 through 1.1

Affected technology

WP Posts Password Batch Manager · 0 through 1.1
Vendor not specified by the source

Description’s affected range: through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attackers can reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password. Source advisory’s CVSS 3.1 assessment (base score 8.6/10) rates confidentiality and availability impact as low; integrity impact as high.