The Passster WordPress plugin, before version 4.3.9, incorrectly evaluates its own public endpoint paths when deciding which REST API requests may bypass global password protection. It compares them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password‑protected posts and pages. The vulnerability is an authorization bypass that results in disclosure of confidential content; it does not directly provide code execution or denial of service.

Vendors and products affected are the Passster plugin for WordPress. Any WordPress installation using Passster prior to version 4.3.9 is vulnerable. The issue is present across all operating systems and WordPress configurations that enable global password protection on posts and pages while the plugin is active.

The vulnerability carries a CVSS score of 5.3, indicating a moderate severity. EPSS is not available, and the CVE is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the plugin’s REST API endpoints, which an attacker can craft by simply appending a matching path segment to a request URI. No additional authentication or privileged access is required to exploit this flaw, so the risk of successful exploitation is high for sites that have the plugin installed and have enabled global password protection.