PT-2023-12070 · WordPress · Passster

Dc11 · Published 2023-01-23 · Updated 2025-04-02 · CVE-2021-24881

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Passster WordPress plugin versions prior to 3.5.5.9

Description The issue allows unauthenticated users to bypass the protection offered by the plugin and access arbitrary posts, such as private content, by sending a specifically crafted request. This is due to the plugin not properly checking for password and public post status.

Recommendations For Passster WordPress plugin versions prior to 3.5.5.9, update to version 3.5.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive posts until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2021-24881

Affected Products

Passster

References · 5

• 🔥 https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24881 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24881 · Vendor Advisory
• https://t.me/cvenotify/117381 · Telegram Post
• https://t.me/cvenotify/43118 · Telegram Post