CVE-2026-17559

MediumCVSS 5.3/10Last modified Oct 16, 2026

Description

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
UnknownPassster>= 4.3.3, < 4.3.9

References

Timeline

Published
Aug 21, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-17568.8The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WP_FOFT_LoaderCVE-2026-175619.8Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. CoCVE-2026-175626.5Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not PropCVE-2026-175635.3The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submisCVE-2026-175657.2The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host CVE-2026-175669.9pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template CVE-2026-175675.3The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure DiCVE-2026-175688.8Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holCVE-2026-175694.3Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry CVE-2026-17576.2A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input isCVE-2026-175704.3Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose CVE-2026-175716.1The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected C