{
 "id": "WPSEC-2026-1467",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1467/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1467/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1467/index.md",
 "title": "Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint",
 "description": "The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via the oEmbed endpoint in all versions up to, and including, 1.6.0. This is due to the plugin not applying its restriction checks to the /oembed/1.0/embed REST endpoint or to internal embeds through the oembed_request_post_id filter. This makes it possible for unauthenticated attackers to get the title, author name and embed markup of restricted pages and posts.",
 "plugin": {
  "slug": "page-and-post-restriction",
  "name": "Page and Post Restriction",
  "full_name": "Page and Post Restriction",
  "wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
  "advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.1",
 "remediation": "Update to 1.6.1 or later.",
 "fix_released": "2026-10-21T16:13:57+00:00",
 "published": "2026-10-22T16:48:21+00:00",
 "updated": "2026-10-22T09:33:17.174410+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1467/",
  "https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/",
  "https://wordpress.org/plugins/page-and-post-restriction/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}