CVE-2026-16983: Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/gutentorto a version that resolves this vulnerability.Fixed in 4.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with at least the Subscriber role can access the affected REST endpoint. Unauthenticated visitors are not described as able to exploit it.
What information is exposed?
The affected endpoint can disclose plaintext passwords assigned to password-protected posts. The disclosure occurs because the endpoint does not apply the correct context restriction.
Which deployments are affected?
Gutentor versions before 4.0.6 are affected. The issue applies where password-protected posts exist and users can authenticate with at least a Subscriber account.
How can I determine whether my site may already be exposed?
Check whether Gutentor is installed at a version earlier than 4.0.6, whether the site contains password-protected posts, and whether Subscriber-or-higher accounts can authenticate. Those conditions indicate that the described exposure may be reachable.