Vulnerabilities / Page and Post Restriction / WPSEC-2026-1468
Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via Role-Restricted Pages and Posts
Low 3.7
CWE-863Fixed in 1.6.1
- ID
- WPSEC-2026-1468
- Plugin
- Page and Post Restriction (page-and-post-restriction)
- Affected
- all versions before 1.6.1
- Remediation
- Update to 1.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Page and Post Restriction on WPSec AttackSurface
- Fix released
- Published
Description
The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass in all versions up to, and including, 1.6.0. This is due to the front-end restriction logic only blocking guests when the 'Require Login' option was set, so pages and posts configured with role-based restrictions but without 'Require Login' were not protected from logged-out visitors. This makes it possible for unauthenticated attackers to view pages and posts that were meant to be limited to specific user roles, when such a restriction is configured.
References
- https://wpsec.com/vuln/WPSEC-2026-1468/
- https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/
- https://wordpress.org/plugins/page-and-post-restriction/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS