CVE-2026-16603

Summary

The flaw allows unauthenticated users to access protected content via the WordPress REST API, bypassing category-based restrictions.

Exploitability

Exploitation is relatively easy as no authentication is required, and only the core REST API needs to be accessed.

Blast radius

If exploited, it could lead to unauthorized access to sensitive post details, compromising user privacy.

Prioritized remediation

Update Passster WordPress plugin to version 4.3.6 or later to enforce category-based content protection on the REST API.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.