CVE-2026-17559: 
WordPress vulnerability analysis and mitigation

CVE-2026-17559 is an unauthenticated protected content disclosure vulnerability in the Passster (Content Protector) WordPress plugin affecting versions 4.3.3 through before 4.3.9. The flaw allows unauthenticated attackers to bypass global password protection and read the content of protected posts and pages via crafted REST API requests. It was publicly disclosed on August 17, 2026, by researcher Erwan LR of WPScan, and assigned a CVSS v3.1 base score of 5.3 (Medium) (WPScan, Github Advisory).

The root cause is an incorrect authorization check (CWE-863) in the plugin's REST API path allowlist logic. When determining whether a REST API request should bypass global password protection, the plugin compares its own public endpoint paths as an unanchored substring of the full request URI rather than matching against the resolved route. An attacker can craft a request URI that contains the allowlisted path as a substring — without actually targeting that route — causing the plugin to incorrectly grant bypass access to password-protected content. No authentication or special privileges are required, and attack complexity is low (WPScan, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to read the full content of posts and pages that are globally protected by the Passster plugin's password mechanism. The impact is limited to confidentiality — there is no integrity or availability impact — but any sensitive content hidden behind the plugin's password protection (e.g., premium content, private business information, restricted documentation) is exposed. The vulnerability does not enable lateral movement or code execution, but the data exposure risk is significant for sites relying on Passster as their primary content protection mechanism (WPScan, Github Advisory).

No public proof-of-concept exploit is currently available; WPScan has indicated the PoC will be published on August 31, 2026, to allow time for users to update (WPScan). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. CISA's SSVC assessment classifies the vulnerability as automatable with partial technical impact, and exploitation is currently listed as "none" (Github Advisory). The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify WordPress sites using the Passster (Content Protector) plugin versions 4.3.3–4.3.8, for example by scanning for the plugin's presence via WordPress plugin enumeration tools (e.g., WPScan CLI) or by checking /wp-content/plugins/content-protector/ paths.
2. Identify allowlisted REST endpoint: Determine the plugin's known public REST API endpoint path(s) that are on the bypass allowlist (e.g., a Passster-specific REST route such as /wp-json/passster/v1/...).
3. Craft bypass request: Construct a REST API request URI that embeds the allowlisted endpoint path as a substring within a URI that actually resolves to a protected post or page endpoint — exploiting the unanchored substring comparison flaw (e.g., /wp-json/wp/v2/posts/123?passster/v1/public).
4. Send unauthenticated request: Issue the crafted HTTP GET request to the target WordPress site without any authentication headers or cookies.
5. Read protected content: The plugin's allowlist check incorrectly matches the embedded substring and grants bypass access, returning the full content of the globally password-protected post or page in the API response (WPScan).

• Network: Unusual unauthenticated REST API requests to WordPress endpoints (e.g., /wp-json/wp/v2/posts/ or /wp-json/wp/v2/pages/) containing Passster-specific path strings (e.g., passster) as query parameters or embedded substrings in the URI.
• Logs: WordPress or web server access logs showing repeated unauthenticated GET requests to REST API endpoints with anomalous URI structures that include Passster route fragments; HTTP 200 responses to such requests from unauthenticated sources.
• Logs: Requests originating from automated scanning tools (high request rates, sequential post/page ID enumeration) targeting REST API endpoints on sites running the Passster plugin.

The vendor has released a patched version: update the Passster (Content Protector) WordPress plugin to version 4.3.9 or later immediately (WPScan). If immediate patching is not possible, consider temporarily disabling the plugin or restricting access to the WordPress REST API (e.g., via firewall rules or a security plugin) until the update can be applied. Sites that do not use global password protection via Passster are not affected by this specific bypass.

The vulnerability was discovered and reported by Erwan LR of WPScan, who is also the submitter (WPScan). WPScan has followed a coordinated disclosure approach, withholding the full proof-of-concept until August 31, 2026, to give site administrators time to update. No significant broader media coverage or notable community commentary has been identified beyond standard vulnerability database aggregation.