CVE-2021-24881: Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-23 · updated 2026-06-17

Description

The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.

Affected products

Passster Project Passter: before 3.5.5.9 — fixed in 3.5.5.9

How to fix

Upgrade to a fixed version: Passster Project Passter 3.5.5.9. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071
https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071

Get alerted when CVE-2021-24881 or the next vulnerability affects your stack