CVE-2026-17559

The Passster WordPress plugin vulnerability (CVE-2026-17559) comes down to a substring check on the request URI that was never anchored to the actual route boundary. The plugin checks whether the incoming URI contains '/wp-json/passster/v1/public' as a substring and exempts such requests from password protection. Because the check is unanchored, any URI containing that path string will bypass protection — regardless of what else the URI contains or where the substring appears. An attacker doesn't need credentials; they need only know that protected content exists behind Passster's global protection mechanism. This matters more than the CVSS 5.3 suggests. Passster's global password feature doesn't protect individual posts — it protects everything marked private across the site. Membership sites, internal wikis, pre-launch content, and any publisher-created category of protected material collapses under a single bypass condition. The substring logic makes the bypass list effectively irrelevant because any URI containing a protected path substring wins. This is a total failure mode, not a granular one. The fix requires more than patching the substring check. First, replace the string containment test with WordPress's `rest_get_endpoint_to_route()` or `get_rest_route()` functions, which resolve the actual endpoint the request maps to. Second, audit every entry in the bypass list — those entries represent historical decisions about threat models that may no longer apply, and they're being modified constantly by developers who don't realize they're changing a security boundary. Third, treat the bypass check code as security-critical regardless of how mundane it appears in the codebase. The deployment-specific nature of this vulnerability is worth emphasizing: whether the raw request URI diverges from the resolved route depends on the WordPress rewrite configuration, which means the actual exploitability varies by site. This partially explains why the issue persisted long enough to receive a CVE — static analysis tools can't model which URIs a given WordPress instance will generate, so the unanchored substring creates bypasses that aren't visible during code review. Patch the mechanism, but also review what the bypass list actually contains and whether those entries still make sense.

Reviewed through automated stages and approved by a human before publication.