CVE-2026-16603 — Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full con…
Published: 2026-08-05 · CVSS: 7.5 · CVSS 3.1
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7