Vulnerability · Published Oct 11, 2026 · Assigned by WPScan

CVE-2026-89283WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite

High 8.6

In plain English

A high-severity missing authorization in WP Posts Password Batch Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Posts Password Batch Manager	0 – through 1.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://wpscan.com/vulnerability/38498e0f-1770-4fff-a882-b11b29b15213/ exploit, vdb-entry, technical-description