The WordPress Passster plugin suffers from a missing authorization flaw that allows attackers to exploit improperly configured access‑control settings, granting them unauthorized access to protected content. This vulnerability is classified as CWE‑862 and can result in the disclosure of restricted material. The issue affects all releases of Passster up to and including version 4.3.18.

The affected product is the Passster content‑protector plugin from WP Chill. All versions from the earliest release through 4.3.18 are impacted.

The CVSS score of 5.3 indicates moderate severity, but there is no EPSS data available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could potentially exploit the flaw remotely via the web interface of the plugin, bypassing authentication controls to view, download, or otherwise access content that should be restricted. No published exploits are known, but the lack of access control could be leveraged by anyone with network access to the WordPress site.