CVE-2026-16983 - Vulnerability Details - OpenCVE

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Gutentor	Gutentor
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/30862f10-a2e6-4536-9a96-bbd8789b954f/

History

Wed, 02 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-284

Wed, 02 Sep 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 02 Sep 2026 07:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gutentor Gutentor gutentor Wordpress Wordpress wordpress
Weaknesses		CWE-200 CWE-284
Vendors & Products		Gutentor Gutentor gutentor Wordpress Wordpress wordpress

Wed, 02 Sep 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
Title		Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API
References		https://wpscan.com/vulnerability/30862f10-a2e6-4536-9a96-bbd8789b954f/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-09-02T06:00:17.090Z

Updated: 2026-09-02T10:45:58.874Z

Reserved: 2026-07-24T08:42:17.658Z

Link: CVE-2026-16983

Vulnrichment

Updated: 2026-09-02T10:13:16.857Z

NVD

Status : Deferred

Published: 2026-09-02T06:17:16.547

Modified: 2026-09-03T17:49:19.180

Link: CVE-2026-16983

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16983", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-07-24T08:42:17.658Z", "datePublished": "2026-09-02T06:00:17.090Z", "dateUpdated": "2026-09-02T10:45:58.874Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-02T06:00:17.090Z"}, "title": "Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API", "problemTypes": [{"descriptions": [{"description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Gutentor", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "4.0.6"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role."}], "references": [{"url": "https://wpscan.com/vulnerability/30862f10-a2e6-4536-9a96-bbd8789b954f/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Ezekiel Victor", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-16983", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-02T10:30:24.437554Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T10:45:58.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-16983", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-02T10:30:24.437554Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T10:13:16.857Z"}}], "cna": {"title": "Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ezekiel Victor"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Gutentor", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/30862f10-a2e6-4536-9a96-bbd8789b954f/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-200 Information Exposure"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-02T06:00:17.090Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16983", "state": "PUBLISHED", "dateUpdated": "2026-09-02T10:45:58.874Z", "dateReserved": "2026-07-24T08:42:17.658Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-09-02T06:00:17.090Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}