Page and Post Restriction
Page and Post Restriction (page-and-post-restriction) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 7.5.
page-and-post-restrictionCVE-2026-12000: Page and Post Restriction REST guards bypass global private-content toggles
Page and Post Restriction through 1.4.1 fails to enforce its global Make all Pages Private and Make all Posts Private settings on the core /wp-json/wp/v2/pages and /wp-json/wp/v2/posts collection and item endpoints. papr_restrict_page_post_rest_api() and papr_filter_posts() obtain restricted IDs from papr_get_restricted_posts_id(), which reads only per-content options and ignores papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts. An unauthenticated caller can therefore retrieve the full rendered content of published pages and posts intended to be private. The CNA prose says 1.4.0, but its structured affected data includes 1.4.1 and the linked patch moves from 1.4.1 to 1.4.2.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-12000
Page and Post Restriction REST guards bypass global private-content toggles
Page and Post Restriction through 1.4.1 fails to enforce its global Make all Pages Private and Make all Posts Private settings on the core /wp-json/wp/v2/pages and /wp-json/wp/v2/posts collection and item endpoints. papr_restrict_page_post_rest_api() and papr_filter_posts() obtain restricted IDs from papr_get_restricted_posts_id(), which reads only per-content options and ignores papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts. An unauthenticated caller can therefore retrieve the full rendered content of published pages and posts intended to be private. The CNA prose says 1.4.0, but its structured affected data includes 1.4.1 and the linked patch moves from 1.4.1 to 1.4.2.
|
1.4.2 |
CVE7.5
NVDPending
|
| Dec 20, 2024 |
CVE-2024-11297
Page Restriction WordPress (WP) – Protect WP Pages/Post: Sensitive information exposure
Page Restriction WordPress (WP) – Protect WP Pages/Post is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE5.3
NVD7.5
|