Restricted Site Access <= 7.6.3 - Unauthenticated Authentication Bypass via 'page_id' and 'pagename' Query Parameters
- ID
- WPSEC-2026-1034
- Plugin
- Restricted Site Access (restricted-site-access)
- Affected
- from 4.0 before 7.6.4
- Remediation
- Update to 7.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- Restricted Site Access on WPSec AttackSurface
- Fix released
- Published
Description
The Restricted Site Access plugin for WordPress is vulnerable to Authentication Bypass via the 'page_id' and 'pagename' query parameters in all versions up to, and including, 7.6.3, due to an insufficient check of whether a request is for the page shown to restricted visitors. When the 'Show them a page' restriction mode is used, a request counted as being on the selected page whenever either parameter matched that page, and all other query variables were ignored. This makes it possible for unauthenticated attackers to add the selected page's ID or slug to requests that carry other query variables, such as 'rest_route', and read restricted site content, including data from the REST API.
References
- https://wpsec.com/vuln/WPSEC-2026-1034/
- https://plugins.svn.wordpress.org/restricted-site-access/tags/7.6.4/
- https://wordpress.org/plugins/restricted-site-access/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS