Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via REST API 'id' Parameter
- ID
- WPSEC-2026-1466
- Plugin
- Page and Post Restriction (page-and-post-restriction)
- Affected
- all versions before 1.6.1
- Remediation
- Update to 1.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Page and Post Restriction on WPSec AttackSurface
- Fix released
- Published
Description
The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass via the REST API in all versions up to, and including, 1.6.0. This is due to the REST restriction check only validating the post or comment ID in the route path, while WordPress lets a query-string or body 'id' parameter override the route ID and matches routes case-insensitively. This makes it possible for unauthenticated attackers to read the content of restricted pages and posts, and comments on them, by requesting an accessible item's endpoint with the restricted item's ID in the 'id' parameter or by using a differently-cased route.
References
- https://wpsec.com/vuln/WPSEC-2026-1466/
- https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/
- https://wordpress.org/plugins/page-and-post-restriction/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS