{"id":"CVE-2026-89283","published":"2026-10-11T07:17:28.330","lastModified":"2026-10-13T16:29:21.907","description":"The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/38498e0f-1770-4fff-a882-b11b29b15213/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP Posts Password Batch Manager plugin fails to verify user capabilities or nonces when processing bulk password actions, allowing unauthenticated attackers to modify passwords for all published posts. This creates a high-risk scenario where attackers can either expose password-protected content or lock down all posts with their own passwords.","exploitability":"Exploitation is straightforward requiring no authentication and no specific preconditions, as the vulnerability exists in an always-loaded admin handler that processes bulk post-password actions without any access controls.","blast_radius":"If exploited, this vulnerability could affect all published posts on a WordPress site, potentially exposing sensitive content or making all posts inaccessible to legitimate users until manually corrected.","remediation":"Upgrade to version 1.2 or later which includes capability and nonce checks for bulk post-password actions.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["wordpress","auth-bypass","bulk-action"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:06:09.575Z"}}