The Passster WordPress plugin, when set to any version earlier than 4.3.6, fails to perform a post‑status check before returning post content from an unauthenticated REST endpoint that is linked to a captcha system. As a result, visitors who send a request to the predictable endpoint can retrieve the full body of posts that are marked drafted, private, or pending. This flaw directly exposes confidential content that should remain hidden, meeting the definition of a confidentiality breach (CWE‑200).

Any WordPress site that has the Passster plugin installed at a version prior to 4.3.6 and has a captcha provider configured is vulnerable. The weakness is confined to the plugin’s REST interface and is not mitigated by theme or server configuration changes.

Exploitation requires no authentication; an attacker can issue a standard HTTP request to the exposed endpoint, complete the captcha challenge, and receive the contents of non‑public posts. Because the pathway is publicly reachable and requires only an unauthenticated request, the likelihood of exploitation is low (EPSS < 1%) but the impact is severe, as indicated by the CVSS score of 7.5. The vulnerability is not listed in CISA’s KEV catalog, yet its lack of a status check represents a critical access‑control failure.