MajorCritical vulnerability

CVE-2026-89283 (CVSS 8.6)

NVD · officialPublished Oct 11, 2026Risk 37/100EPSS 0.1%

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.

Technical details

CVSS

8.6

AV:NetworkAC:LowPR:NoneUI:NoneC:LowI:HighA:Low

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source