AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-16603

HIGH · CVSS 7.5 EPSS 0.32%

Source: NVD + CISA KEV + EPSS · Published 2026-08-05 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The Passster WordPress plugin prior to version 4.3.6 is vulnerable as it fails to enforce category-based content protection on the WordPress REST API, enabling unauthenticated users to access the full content, title, and excerpt of posts that should be restricted. This exposure can lead to unauthorized information disclosure, potentially compromising sensitive content. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.

CVE
CVE-2026-16603
Severity
HIGH
CVSS
7.5
EPSS
0.32%
WordPress

Original NVD Description

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.