{
 "id": "WPSEC-2026-1469",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1469/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1469/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1469/index.md",
 "title": "Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via Comment Feeds and Comment Lists",
 "description": "The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via comment feeds and front-end comment lists in all versions up to, and including, 1.6.0. This is due to the plugin only filtering comments on restricted content for REST comment routes, leaving comment feeds and front-end comment queries such as the Recent Comments widget unfiltered. This makes it possible for unauthenticated attackers to read comments posted on restricted pages and posts, along with the titles and permalinks of those restricted items.",
 "plugin": {
  "slug": "page-and-post-restriction",
  "name": "Page and Post Restriction",
  "full_name": "Page and Post Restriction",
  "wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
  "advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.1",
 "remediation": "Update to 1.6.1 or later.",
 "fix_released": "2026-10-21T16:13:57+00:00",
 "published": "2026-10-22T16:48:21+00:00",
 "updated": "2026-10-22T09:33:17.174410+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1469/",
  "https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/",
  "https://wordpress.org/plugins/page-and-post-restriction/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}