CVE-2026-89283

Summary

The WP Posts Password Batch Manager plugin fails to verify user capabilities or nonces when processing bulk password actions, allowing unauthenticated attackers to modify passwords for all published posts. This creates a high-risk scenario where attackers can either expose password-protected content or lock down all posts with their own passwords.

Exploitability

Exploitation is straightforward requiring no authentication and no specific preconditions, as the vulnerability exists in an always-loaded admin handler that processes bulk post-password actions without any access controls.

Blast radius

If exploited, this vulnerability could affect all published posts on a WordPress site, potentially exposing sensitive content or making all posts inaccessible to legitimate users until manually corrected.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.2 or later which includes capability and nonce checks for bulk post-password actions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.