blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-89283

HIGH 8.6 CVSS 3.1
Published
October 11, 2026
Last modified
October 13, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Description

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.

Affected WordPress components

  • WP Posts Password Batch Manager Plugin · wp-posts-password-batch-manager
    Possible match Homeless
    Up to and including 1.1
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown WP Posts Password Batch Manager — Up to and including 1.1

References

  • wpscan.com https://wpscan.com/vulnerability/38498e0f-1770-4fff-a882-b11b29b15213/
  • nvd.nist.gov Official NVD record