CVEvulnerability

CVE-2025-15674

2.7 LOW Published 2026-08-06 Modified 2026-09-29 Official page ↗
Status
Deferred
Published
2026-08-06
Last modified
2026-09-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863

Description

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References