Technical impact
A missing authorization control in the WP Chill Passster content‑protector plugin enables an attacker to obtain protected content without proper authentication. Because the plugin does not enforce access checks for certain content levels, a user can craft URLs or API requests to retrieve resources that should be restricted. The flaw is an example of weak access control and can allow privilege escalation within the site by accessing confidential posts, pages, or documents. This type of vulnerability can lead to information disclosure and compromise the integrity of site content.
Affected Systems
The vulnerability affects the Passster content‑protector plugin supplied by WP Chill. All releases from the earliest available version up to and including 4.3.20 are impacted. Versions 4.3.21 and later are considered fixed; no other vendors or external products are noted.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate severity with respect to confidentiality, integrity, and availability. The EPSS score is not available, so the probability of exploitation in the wild cannot be precisely quantified, but the lack of a defense‑in‑depth check makes the flaw readily exploitable by an attacker who can access the web interface. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not been observed in widely known or reported attacks yet, but the risk remains significant for any site relying on Passster’s access‑control functions.
