CVE-2025-15674 — LOW (2.7) — White Hats Nepal

Vulnerability Description

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

CVSS Score

2.7

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-863

References

https://wpscan.com/vulnerability/1bcf4ddd-ce9c-40bc-80f7-54ad9f23f39a/

FAQ

What is CVE-2025-15674?

CVE-2025-15674 is a vulnerability with a CVSS score of 2.7 (LOW). The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API ...

How severe is CVE-2025-15674?

CVE-2025-15674 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-15674?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.