High severity · published Jan 23, 2023
CVE-2021-24881
Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Passster ·
before 3.5.5.9 · source: vendor
PA
Passter · Passster Project
before 3.5.5.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24881
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24881
Exploit
https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071
More from Passster
7.5
CVE-2026-16604
Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute
7.5
CVE-2026-16603
Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API
7.5
CVE-2026-16602
Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint
5.9
CVE-2022-3206
Passster < 3.5.5.5.2 - Insecure Storage of Password
5.4
CVE-2021-24837
Passster < 3.5.5.8 - Contributor+ Stored Cross-Site Scripting