{
 "id": "WPSEC-2026-1466",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1466/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1466/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1466/index.md",
 "title": "Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via REST API 'id' Parameter",
 "description": "The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass via the REST API in all versions up to, and including, 1.6.0. This is due to the REST restriction check only validating the post or comment ID in the route path, while WordPress lets a query-string or body 'id' parameter override the route ID and matches routes case-insensitively. This makes it possible for unauthenticated attackers to read the content of restricted pages and posts, and comments on them, by requesting an accessible item's endpoint with the restricted item's ID in the 'id' parameter or by using a differently-cased route.",
 "plugin": {
  "slug": "page-and-post-restriction",
  "name": "Page and Post Restriction",
  "full_name": "Page and Post Restriction",
  "wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
  "advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.1",
 "remediation": "Update to 1.6.1 or later.",
 "fix_released": "2026-10-21T16:13:57+00:00",
 "published": "2026-10-22T16:48:21+00:00",
 "updated": "2026-10-22T09:33:17.174410+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1466/",
  "https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/",
  "https://wordpress.org/plugins/page-and-post-restriction/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}