Unrated severityNVD Advisory· Published Aug 5, 2026· Updated Aug 5, 2026
Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint
CVE-2026-16602
Description
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/fcca0d1c-1a5b-4515-8182-d68f0759b978/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.