CVE-2025-15489: Passster < 4.2.24 - Password Protection Bypass
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit the vulnerable AJAX action. No account, privileges, or user interaction are required.
What information can an attacker obtain?
An attacker can retrieve the value of content protected by Passster passwords. The available data indicates confidentiality impact only; it does not indicate modification or service-disruption impact.
Which installations are affected?
WordPress sites using the Passster plugin with a version earlier than 4.2.24 are affected. The provided information does not identify any configuration prerequisite beyond use of a vulnerable plugin version.
How can I determine whether my site is vulnerable?
Check the installed Passster plugin version. Versions before 4.2.24 should be treated as vulnerable based on the available information.