CVE-2026-16983

MediumCVSS 4.3/10Last modified Sep 3, 2026

Description

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Gutentor	< 4.0.6

References

https://wpscan.com/vulnerability/30862f10-a2e6-4536-9a96-bbd8789b954f/

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-169846.5The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not i CVE-2026-169858.8The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its at CVE-2026-169865.3The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, derivi CVE-2026-169877.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment var CVE-2026-169887.5The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single reque CVE-2026-169897.8IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symboli CVE-2026-16998.8In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while ch CVE-2026-169905.3The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a clie CVE-2026-169917.8IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic CVE-2026-169926.5The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, a CVE-2026-169933.7The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-ind CVE-2026-169968.8IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an integer underflow.