CVE-2026-16603

The Passster WordPress plugin is affected by CVE-2026-16603: versions prior to 4.3.6 do not enforce category-based content protection on the WordPress REST API, allowing unauthenticated users to read full content, title, and excerpt of category-locked posts via the core REST API. This is an unaut...

CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...