Page and Post Restriction
Page and Post Restriction (page-and-post-restriction) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; the highest published CVSS base score is 7.5.
page-and-post-restrictionCVE-2026-118194: Page and Post Restriction: Authentication bypass
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the papr_restrict_page_post_rest_api() function, hooked on rest_pre_dispatch, re-authenticating the current user from the wordpress_logged_in cookie via wp_set_current_user() for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's rest_cookie_check_errors() performs on cookie-authenticated requests that lack an X-WP-Nonce header or _wpnonce parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request Origin and sets Access-Control-Allow-Credentials: true — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via /wp-json/wp/v2/users/me, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin fetch requests against the target site's REST API; no nonce or further victim interaction beyond the page visit is needed. The structured affected range is <= 1.6.1.
| Safe version |
|
||
|---|---|---|---|
| Oct 30, 2026 |
CVE-2026-118194
Page and Post Restriction: Authentication bypass
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the papr_restrict_page_post_rest_api() function, hooked on rest_pre_dispatch, re-authenticating the current user from the wordpress_logged_in cookie via wp_set_current_user() for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's rest_cookie_check_errors() performs on cookie-authenticated requests that lack an X-WP-Nonce header or _wpnonce parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request Origin and sets Access-Control-Allow-Credentials: true — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via /wp-json/wp/v2/users/me, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin fetch requests against the target site's REST API; no nonce or further victim interaction beyond the page visit is needed. The structured affected range is <= 1.6.1.
|
See mitigation notes |
CVE6.5
|
| Oct 29, 2026 |
CVE-2026-54852
Page Restriction WordPress (WP): Missing authorization
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 1.6.1.
|
1.6.2 |
CVE5.3
|
| Oct 22, 2026 |
CVE-2026-114696
Page Restriction WordPress (WP): Missing object or operation authorization
An unauthenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact. Affected versions: at most 1.6.0.
|
1.6.1 |
CVE5.3
|
| Aug 05, 2026 |
CVE-2026-12000
Page and Post Restriction REST guards bypass global private-content toggles
Page and Post Restriction through 1.4.1 fails to enforce its global Make all Pages Private and Make all Posts Private settings on the core /wp-json/wp/v2/pages and /wp-json/wp/v2/posts collection and item endpoints. papr_restrict_page_post_rest_api() and papr_filter_posts() obtain restricted IDs from papr_get_restricted_posts_id(), which reads only per-content options and ignores papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts. An unauthenticated caller can therefore retrieve the full rendered content of published pages and posts intended to be private. The CNA prose says 1.4.0, but its structured affected data includes 1.4.1 and the linked patch moves from 1.4.1 to 1.4.2.
|
1.4.2 |
CVE7.5
|
| Dec 20, 2024 |
CVE-2024-11297
Page Restriction WordPress (WP) – Protect WP Pages/Post: Sensitive information exposure
Page Restriction WordPress (WP) – Protect WP Pages/Post is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
|