CVE-2026-16983 — Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected p…
Published: 2026-09-02 · CVSS: 4.3 · CVSS 3.1
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7