826 matches found
CVE-2026-78149
The Smart Post WordPress plugin (Post Grid, Post Carousel, & List Category Posts) versions 4.0.0 through 4.0.7 are affected by an unauthenticated information disclosure vulnerability in the sp_handle_post_id AJAX action. The plugin fails to check whether a post is password-protected before return...
EUVD-2026-71849
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...
CVE-2026-78149 Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_id
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...
PT-2026-86332
šØ CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards...
EUVD-2026-57452
SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password...
GHSA-MP7R-57W4-5QM3 SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password
CVE: This vulnerability corresponds to CVE-2026-72792. Summary /api/tag/getTag filters its results for reader roles through FilterTagsByPublishIgnore, which checks only the visible publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered...
CVE-2025-15489
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...
EUVD-2025-210831
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-77782
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
CVE-2026-77782
The Rank Math SEO WordPress plugin, versions before 1.0.277.1 , fails to check whether a post is password-protected before using its content to build publicly generated SEO metadata (via post metadata and llms.txt ). This allows unauthenticated users to read the content of password-protected post...
EUVD-2026-69837
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability
Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...
CVE-2026-16983
The Gutentor WordPress plugin (versions before 4.0.6 ) fails to apply the correct context restriction on one of its REST endpoints , exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role. The vulnerability was discovered by Ezekie...
WordPress Gutentor plugin < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure vulnerability
Subscriber+ Password Protected Post Password Disclosure vulnerability discovered by Ezekiel Victor in WordPress Plugin Gutentor versions 4.0.6...
CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...
Astra Linux ā Vulnerability in imagemagick
ImageMagick versions before 6.9.11-40 and 7.x before 7.0.10-40 mishandle the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized, allowing additional shell commands to be injected through...
CVE-2026-66916 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...
CVE-2026-16612
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...