The Passster WordPress plugin versions prior to 4.3.6 do not perform a post-status check when responding to requests on an unauthenticated REST endpoint. Consequently, unauthenticated users can retrieve the content of non-public posts such as drafts, private, and pending posts if the site has a captcha provider configured. This constitutes an information disclosure vulnerability classified as CWE-200. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality only.

An attacker can disclose sensitive content from non-public posts on affected WordPress sites without authentication. This compromises the confidentiality of draft, private, and pending posts, potentially exposing unpublished or restricted information.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, site administrators should consider disabling the vulnerable REST endpoint or removing the captcha provider configuration if feasible to reduce exposure.