CVE-2026-17559

Name of the Vulnerable Software and Affected Versions Passster WordPress plugin versions prior to 4.3.9

Description The plugin fails to correctly match its public endpoint paths when determining which REST API requests should bypass global password protection. This occurs because the system compares paths as an unanchored substring of the request URI instead of using the resolved route. Consequently, an unauthenticated attacker can read the content of posts and pages that are globally password-protected.

Recommendations Update Passster WordPress plugin to version 4.3.9 or later.