{"id":"CVE-2026-121776","kind":"vulnerability","aliases":["CVE-2026-121776"],"related":[],"title":"WordPress Passster plugin: missing authorization lets visitors bypass content protection","description":"Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.","summary":"The Passster content-protector plugin for WordPress has a missing authorization check, described as exploiting incorrectly configured access control levels. An attacker may be able to reach content that the site owner meant to lock behind a password or access rule.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"passster","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","passster","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check whether the WordPress site runs the Passster plugin and read its installed version in the plugin list\n- Compare the installed version with the affected range: Passster through `4.3.20`","fix":"- Passster: a version newer than `4.3.20` (the sources do not name the fixed release)","status":"open","published_at":"2026-11-13T15:17:33+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:54+00:00","updated_at":"2026-11-13T15:48:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:54Z","model":"claude-haiku-5-5","output":{"fix":"- Passster: a version newer than `4.3.20` (the sources do not name the fixed release)","reach":"internet","title":"WordPress Passster plugin: missing authorization lets visitors bypass content protection","impact":"medium","summary":"The Passster content-protector plugin for WordPress has a missing authorization check, described as exploiting incorrectly configured access control levels. An attacker may be able to reach content that the site owner meant to lock behind a password or access rule.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","passster","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Protected content becomes readable without the intended access check","analyst_note":"Confirm the fixed Passster version and the exact access-control configuration that triggers the flaw from the NVD or vendor advisory page.","how_to_check":"- Check whether the WordPress site runs the Passster plugin and read its installed version in the plugin list\n- Compare the installed version with the affected range: Passster through `4.3.20`\n- unknown for other checks, the sources do not say","plain_action":"","product_name":"passster","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the Passster WordPress plugin at version 4.3.20 or earlier are in scope, most likely those that use it to restrict pages or content. Sites without Passster, or with a newer version, are not affected. The sources do not describe the exact configuration that triggers the flaw beyond incorrectly configured access control levels.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000756,"input_tokens":4530,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121776':13A,16A '-2026':12A,15A '4.3.20':90C 'abl':49B 'access':42B,64B,80C 'affect':85C 'allow':76C 'attack':46B 'author':5A,35B,67C 'behind':60B 'bypass':8A 'check':36B 'chill':71C 'configur':41B,79C 'content':9A,27B,52B,74C 'content-protector':26B,73C 'control':43B,81C 'cve':11A,14A 'describ':37B 'exploit':39B,77C 'host':22B 'incorrect':40B,78C 'issu':84C 'let':6A 'level':44B 'levels.this':83C 'lock':59B 'may':47B 'meant':57B 'miss':4A,34B,66C 'n/a':88C 'owner':56B 'packag':18B 'passster':2A,17A,19B,25B,72C,86C 'password':62B 'plugin':3A,29B 'protect':10A 'protector':28B,75C 'reach':51B 'rule':65B 'secur':82C 'self':21B 'self-host':20B 'site':55B 'visitor':7A 'vulner':68C 'wordpress':1A,23B,31B 'wp':70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Passster WordPress plugin at version 4.3.20 or earlier are in scope, most likely those that use it to restrict pages or content. Sites without Passster, or with a newer version, are not affected. The sources do not describe the exact configuration that triggers the flaw beyond incorrectly configured access control levels.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["passster"],"ptokens":["passster"],"labels":["medium","package","passster","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-121776':13A,16A '-2026':12A,15A 'author':5A 'bypass':8A 'content':9A 'cve':11A,14A 'let':6A 'miss':4A 'passster':2A,17A 'plugin':3A 'protect':10A 'visitor':7A 'wordpress':1A","search_b":"'abl':49B 'access':42B,64B 'attack':46B 'author':35B 'behind':60B 'check':36B 'configur':41B 'content':27B,52B 'content-protector':26B 'control':43B 'describ':37B 'exploit':39B 'host':22B 'incorrect':40B 'level':44B 'lock':59B 'may':47B 'meant':57B 'miss':34B 'owner':56B 'packag':18B 'passster':19B,25B 'password':62B 'plugin':29B 'protector':28B 'reach':51B 'rule':65B 'self':21B 'self-host':20B 'site':55B 'wordpress':23B,31B","search_c":"'4.3.20':90C 'access':80C 'affect':85C 'allow':76C 'author':67C 'chill':71C 'configur':79C 'content':74C 'content-protector':73C 'control':81C 'exploit':77C 'incorrect':78C 'issu':84C 'levels.this':83C 'miss':66C 'n/a':88C 'passster':72C,86C 'protector':75C 'secur':82C 'vulner':68C 'wp':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121776","severity":null,"published_at":"2026-11-13T15:17:33+00:00","modified_at":"2026-11-13T15:17:33+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}