The Passster WordPress plugin contains a critical information disclosure flaw that permits unauthenticated users to bypass category-based access restrictions via the REST API.

The plugin fails to extend its category-based content protection mechanisms to the WordPress core REST API. This allows unauthenticated attackers to read the full content, titles, and excerpts of posts that were intended to be protected.

The CVSS score of 7.5 highlights the potential for widespread data exposure. By bypassing intended access controls, attackers can gain access to sensitive or restricted content, violating site privacy policies and potentially exposing confidential organizational information.

Immediate Action: Update the Passster WordPress plugin to version 4.3.6 or later to ensure that category-based protections are correctly enforced across all API interactions.

Proactive Monitoring: Monitor API traffic for unusual patterns, specifically focusing on requests retrieving content that should be restricted by category.

Compensating Controls: Temporarily disable the WordPress REST API if it is not required for site functionality, or use security plugins to restrict unauthorized access to sensitive API routes.

Public Exploit Available: Yes (public Proof of Concept exists)

This vulnerability effectively nullifies the primary security feature of the Passster plugin. Security teams should ensure the update is applied immediately to restore the integrity of content access controls.