WordPress security changelog
HIGH CVE-2026-12000 Deferred

Page and Post Restriction REST guards bypass global private-content toggles

Page and Post Restriction through 1.4.1 fails to enforce its global Make all Pages Private and Make all Posts Private settings on the core /wp-json/wp/v2/pages and /wp-json/wp/v2/posts collection and item endpoints. papr_restrict_page_post_rest_api() and papr_filter_posts() obtain restricted IDs from papr_get_restricted_posts_id(), which reads only per-content options and ignores papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts. An unauthenticated caller can therefore retrieve the full rendered content of published pages and posts intended to be private. The CNA prose says 1.4.0, but its structured affected data includes 1.4.1 and the linked patch moves from 1.4.1 to 1.4.2.

CVE / CNA score 7.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Page and Post Restriction
Plugin slug
page-and-post-restriction
Affected
<= 1.4.1
Safe version
1.4.2
Published
Aug 05, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Aug 05, 2026 and is one of 2 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Page and Post Restriction to 1.4.2 or later. Treat content protected only by the vulnerable global toggles as potentially public through the REST API and rotate any secrets embedded in those posts or pages.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. This is due to the plugin's REST guards — papr_restrict_page_post_rest_api() and the the_posts filter registered by papr_filter_posts() — sourcing their restricted-ID list exclusively from papr_get_restricted_posts_id(), which only reads the per-page metabox options papr_allowed_redirect_for_pages and papr_allowed_redirect_for_posts and never consults the two global toggles papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts that the plugin's own UI describes as 'Make all Pages Private' / 'Make all Posts Private'. This makes it possible for unauthenticated attackers to read the full rendered content of every published page and post on sites configured with the documented global toggles, bypassing the security boundary enforced on the frontend by papr_restrict_logged_in_users().

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources