CVE-2026-89283: CWE-862 Missing Authorization in WP Posts Password Batch Manager

CVE-2026-89283 is a missing authorization vulnerability (CWE-862) in the WP Posts Password Batch Manager WordPress plugin versions up to 1.1. The plugin fails to verify user capabilities or use nonce checks when performing a bulk action to set post passwords. This bulk action is handled by an admin handler that is always loaded, enabling unauthenticated attackers to reset or overwrite passwords on all published posts. This can lead to unauthorized disclosure of protected content or denial of access by locking posts behind attacker-controlled passwords.

An unauthenticated attacker can reset or overwrite passwords on all published posts, which may disclose password-protected content or lock legitimate users out by setting attacker-chosen passwords. This compromises the confidentiality and availability of post content managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's bulk password management functionality by disabling or removing the plugin if possible. Monitor for updates from the plugin vendor addressing this authorization issue.