CVE-2026-16602: Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Passster (Content Protector)to a version that resolves this vulnerability.Fixed in 4.3.6 - Compensating control
If you cannot upgrade immediately, remove or disable the captcha provider configuration for the Passster captcha REST endpoint to prevent unauthenticated REST requests from disclosing non-public post content.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16602?
CVE-2026-16602 has a risk score of 62, indicating a medium severity vulnerability.
How do I fix CVE-2026-16602?
To fix CVE-2026-16602, update the Passster WordPress plugin to version 4.3.6 or later.
What types of content can be disclosed due to CVE-2026-16602?
CVE-2026-16602 allows the disclosure of non-public content such as draft, private, and pending posts.
Who is affected by CVE-2026-16602?
Sites using the Passster WordPress plugin below version 4.3.6 with a captcha provider configured are affected by CVE-2026-16602.
What is the nature of the vulnerability in CVE-2026-16602?
CVE-2026-16602 is an information leak vulnerability through an unauthenticated REST endpoint that fails to check post statuses.