CVE-2025-15674CWE-863broken-access-control

CVE-2025-15674

Low · published August 7, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-07T02:16Z
References (1)
https://wpscan.com/vulnerability/1bcf4ddd-ce9c-40bc-80f7-54ad9f23f39a/ · [email protected]
EPSS history
Timeline
  • 06 AUG 17:17Z
    Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API
    cvelistv5