{
 "id": "WPSEC-2026-1034",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1034/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1034/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1034/index.md",
 "title": "Restricted Site Access <= 7.6.3 - Unauthenticated Authentication Bypass via 'page_id' and 'pagename' Query Parameters",
 "description": "The Restricted Site Access plugin for WordPress is vulnerable to Authentication Bypass via the 'page_id' and 'pagename' query parameters in all versions up to, and including, 7.6.3, due to an insufficient check of whether a request is for the page shown to restricted visitors. When the 'Show them a page' restriction mode is used, a request counted as being on the selected page whenever either parameter matched that page, and all other query variables were ignored. This makes it possible for unauthenticated attackers to add the selected page's ID or slug to requests that carry other query variables, such as 'rest_route', and read restricted site content, including data from the REST API.",
 "plugin": {
  "slug": "restricted-site-access",
  "name": "Restricted Site Access",
  "full_name": "Restricted Site Access",
  "wordpress_org": "https://wordpress.org/plugins/restricted-site-access/",
  "advisories_url": "https://wpsec.com/vuln/plugin/restricted-site-access/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/restricted-site-access"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0",
    "from_inclusive": true,
    "to": "7.6.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0 before 7.6.4"
  ]
 },
 "introduced_in": "4.0",
 "fixed_in": "7.6.4",
 "remediation": "Update to 7.6.4 or later.",
 "fix_released": "2026-10-14T14:49:20+00:00",
 "published": "2026-10-15T15:42:47+00:00",
 "updated": "2026-10-15T08:16:03.660155+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1034/",
  "https://plugins.svn.wordpress.org/restricted-site-access/tags/7.6.4/",
  "https://wordpress.org/plugins/restricted-site-access/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/restricted-site-access",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}