Passster < 4.2.26 – Global Protection Bypass | CVE 2025-15490 | Plugin Vulnerabilities

Description

The plugin has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs

Proof of Concept

Activate the global protection of the plugin via its settings (/wp-admin/admin.php?page=passster-settings)

Access a page/post from the blog to confirm the protection is active. Then append elementor-preview=1 or lc_action_launch_editing=1 to the URLs to bypass the protection, e.g:

http://wpscan-vulnerability-test-bench.ddev.site/secret-page/?elementor-preview=1
http://wpscan-vulnerability-test-bench.ddev.site/secret-page/?lc_action_launch_editing=1

Affects Plugins

content-protector

Fixed in 4.2.26

References

CVE

Miscellaneous

Original Researcher

Alex Tselevich (nos3curity)

Submitter

Alex Tselevich (nos3curity)

Submitter website

https://nosecurity.blog

Submitter twitter

Verified

Yes

WPVDB ID

87d4768e-48a5-4d91-a5e1-8a84ba2de035

Timeline

Publicly Published

2026-02-17 (about 6 months ago)

Added

2026-02-17 (about 6 months ago)

Last Updated

2026-02-17 (about 6 months ago)

Other

Published

Title

Published

2026-07-30

Title

WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode

Published

2022-12-27

Title

WP Limit Login Attempts <= 2.6.5 - IP Spoofing

Published

2025-11-26

Title

SKT PayPal for WooCommerce < 1.5 - Unauthenticated Payment Bypass

Published

2026-08-03

Title

WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

Published

2022-05-17

Title

iQ Block Country <= 1.2.28 - Protection Bypass due to IP Spoofing