{"id":"CVE-2026-121574","kind":"vulnerability","aliases":["CVE-2026-121574"],"related":[],"title":"WordPress Passster plugin: missing authorization lets visitors bypass content protection","description":"Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.","summary":"The Passster WordPress plugin, which password-protects content, has a missing authorization check in versions through 4.3.20. An attacker may be able to reach protected content or settings without the required access rights.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Passster","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","passster","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check the installed Passster version in the WordPress admin plugin list, or look for the plugin's `passster` folder under `wp-content/plugins/`.\n- Compare the version against the range in the NVD entry (through `4.3.20`).","fix":null,"status":"open","published_at":"2026-11-11T12:19:33+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:56+00:00","updated_at":"2026-11-11T12:28:56+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T12:28:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Passster plugin: missing authorization lets visitors bypass content protection","impact":"medium","summary":"The Passster WordPress plugin, which password-protects content, has a missing authorization check in versions through 4.3.20. An attacker may be able to reach protected content or settings without the required access rights.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","passster","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may access protected content or restricted functions","analyst_note":"Confirm the fixed version and the exact access-control condition from the WP Chill advisory or the Wordfence/WPScan record for CVE-2026-121574.","how_to_check":"- Check the installed Passster version in the WordPress admin plugin list, or look for the plugin's `passster` folder under `wp-content/plugins/`.\n- Compare the version against the range in the NVD entry (through `4.3.20`).","plain_action":"","product_name":"Passster","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the Passster WordPress plugin at or below 4.3.20 that use it to restrict content. Sites without Passster, or with a later version, are not covered by this entry. The sources do not describe the exact access-control configuration needed to trigger it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4530,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121574':13A,16A '-2026':12A,15A '4.3.20':41B,82C 'abl':46B 'access':56B,72C 'affect':77C 'allow':68C 'attack':43B 'author':5A,36B,59C 'bypass':8A 'check':37B 'chill':63C 'configur':71C 'content':9A,32B,50B,66C 'content-protector':65C 'control':73C 'cve':11A,14A 'exploit':69C 'host':22B 'incorrect':70C 'issu':76C 'let':6A 'levels.this':75C 'may':44B 'miss':4A,35B,58C 'n/a':80C 'passster':2A,17A,19B,25B,64C,78C 'password':30B 'password-protect':29B 'plugin':3A,27B 'protect':10A,31B,49B 'protector':67C 'reach':48B 'requir':55B 'right':57B 'secur':74C 'self':21B 'self-host':20B 'set':52B 'version':39B 'visitor':7A 'vulner':60C 'without':53B 'wordpress':1A,23B,26B 'wp':62C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Passster WordPress plugin at or below 4.3.20 that use it to restrict content. Sites without Passster, or with a later version, are not covered by this entry. The sources do not describe the exact access-control configuration needed to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["passster"],"ptokens":["passster"],"labels":["medium","other","passster","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-121574':13A,16A '-2026':12A,15A 'author':5A 'bypass':8A 'content':9A 'cve':11A,14A 'let':6A 'miss':4A 'passster':2A,17A 'plugin':3A 'protect':10A 'visitor':7A 'wordpress':1A","search_b":"'4.3.20':41B 'abl':46B 'access':56B 'attack':43B 'author':36B 'check':37B 'content':32B,50B 'host':22B 'may':44B 'miss':35B 'passster':19B,25B 'password':30B 'password-protect':29B 'plugin':27B 'protect':31B,49B 'reach':48B 'requir':55B 'right':57B 'self':21B 'self-host':20B 'set':52B 'version':39B 'without':53B 'wordpress':23B,26B","search_c":"'4.3.20':82C 'access':72C 'affect':77C 'allow':68C 'author':59C 'chill':63C 'configur':71C 'content':66C 'content-protector':65C 'control':73C 'exploit':69C 'incorrect':70C 'issu':76C 'levels.this':75C 'miss':58C 'n/a':80C 'passster':64C,78C 'protector':67C 'secur':74C 'vulner':60C 'wp':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121574","severity":null,"published_at":"2026-11-11T12:19:33+00:00","modified_at":"2026-11-11T12:19:33+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}