WP Posts Password Batch Manager: Missing authorization in bulk password action
Summary
The WordPress plugin WP Posts Password Batch Manager through version 1.1 does not check user capabilities or nonces on a bulk post-password action running on an always-loaded admin handler. An unauthenticated remote attacker can reset or overwrite the passwords of all published posts, exposing password-protected content or locking all posts behind an attacker-chosen password. No login is required and the attack has low complexity.
Affected
- WP Posts Password Batch Manager (WordPress plugin, slug wp-posts-password-batch-manager) versions 0 to 1.1 inclusive
- Vendor and developer: Unknown
Fixed in
- Unknown. WPScan lists the status as "No known fix".
Workaround
- Deactivate and uninstall the plugin if its functionality is not needed.
- Restrict access to the WordPress admin area by IP address where feasible.
- Back up the website content and database before making any changes.
Exploitation
- No evidence of exploitation in the wild. The CVE is not in the KEV list.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS: below 1 percent (very low).
- Public proof of concept: unclear; no verified exploit code found.
Our recommendation
- Check whether the plugin is installed on any WordPress site, including test and staging systems.
- Deactivate and remove the plugin immediately, as no fixed version is known.
- Check whether password protection on posts has changed unexpectedly and restore the correct settings.
- Review the web server and WordPress logs for unauthenticated requests to the admin area.
- Monitor the vendor and wordpress.org for a fixed version before reinstalling.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-89283 app.opencve.io
- VulDB CVE-2026-89283 vuldb.com
- Vulners NVD record CVE-2026-89283 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:55.
Original description (NVD)
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.