A vulnerability in the Passster WordPress plugin allows unauthenticated attackers to bypass access controls and expose sensitive, non-public post content.

The plugin fails to perform a post-status check when returning content via a specific REST API endpoint. This allows unauthenticated users to access drafts, private posts, and pending content if a captcha provider is configured.

With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality. Unauthorized exposure of non-public posts can lead to the leaking of proprietary information, draft content, or sensitive internal communications, potentially resulting in severe reputational damage.

Immediate Action: Update the Passster WordPress plugin to version 4.3.6 or later to enforce proper post-status verification on the REST API.

Proactive Monitoring: Audit access logs for unusual requests directed at the REST API endpoints associated with the Passster plugin.

Compensating Controls: If immediate patching is not possible, consider disabling the affected REST API functionality or implementing access restrictions at the web server level.

Public Exploit Available: Yes (public Proof of Concept exists)

Organizations relying on Passster to protect post visibility must treat this update with high urgency. Unauthorized access to drafts can undermine the security of the entire content management workflow.