# Restricted Site Access <= 7.6.3 - Unauthenticated Authentication Bypass via 'page_id' and 'pagename' Query Parameters

- **ID:** WPSEC-2026-1034
- **Plugin:** Restricted Site Access (`restricted-site-access`), https://wordpress.org/plugins/restricted-site-access/
- **Affected versions:** from 4.0 before 7.6.4
- **Fixed in:** 7.6.4 (Update to 7.6.4 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/restricted-site-access
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1034/

## Description

The Restricted Site Access plugin for WordPress is vulnerable to Authentication Bypass via the 'page_id' and 'pagename' query parameters in all versions up to, and including, 7.6.3, due to an insufficient check of whether a request is for the page shown to restricted visitors. When the 'Show them a page' restriction mode is used, a request counted as being on the selected page whenever either parameter matched that page, and all other query variables were ignored. This makes it possible for unauthenticated attackers to add the selected page's ID or slug to requests that carry other query variables, such as 'rest_route', and read restricted site content, including data from the REST API.

## References

- https://wpsec.com/vuln/WPSEC-2026-1034/
- https://plugins.svn.wordpress.org/restricted-site-access/tags/7.6.4/
- https://wordpress.org/plugins/restricted-site-access/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1034/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.