# Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via REST API 'id' Parameter

- **ID:** WPSEC-2026-1466
- **Plugin:** Page and Post Restriction (`page-and-post-restriction`), https://wordpress.org/plugins/page-and-post-restriction/
- **Affected versions:** all versions before 1.6.1
- **Fixed in:** 1.6.1 (Update to 1.6.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/page-and-post-restriction
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1466/

## Description

The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass via the REST API in all versions up to, and including, 1.6.0. This is due to the REST restriction check only validating the post or comment ID in the route path, while WordPress lets a query-string or body 'id' parameter override the route ID and matches routes case-insensitively. This makes it possible for unauthenticated attackers to read the content of restricted pages and posts, and comments on them, by requesting an accessible item's endpoint with the restricted item's ID in the 'id' parameter or by using a differently-cased route.

## References

- https://wpsec.com/vuln/WPSEC-2026-1466/
- https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/
- https://wordpress.org/plugins/page-and-post-restriction/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1466/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.