WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API vulnerability

Unauthenticated Category-Locked Content Disclosure via Core REST API vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-16603

The Passster (also known as Content Protector ) WordPress plugin, in versions prior to 4.3.6 , fails to enforce category-based content protection when accessed via the WordPress REST API . This security oversight allows unauthenticated users to bypass intended restrictions and read the full conte...

CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-16603: Exposure of Sensitive Information to an Unauthorized Actor

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...