Page and Post Restriction <= 1.6.1 - Unauthenticated Sensitive Information Exposure via Restricted Post Listings
- ID
- WPSEC-2026-1991
- Plugin
- Page and Post Restriction (page-and-post-restriction)
- Affected
- all versions before 1.6.2
- Remediation
- Update to 1.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- Page and Post Restriction on WPSec AttackSurface
- Fix released
- Published
Description
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via post listings in all versions up to, and including, 1.6.1. This is due to the plugin removing restricted pages and posts only from the main search, feed and REST queries. They stayed in the blog home page, the category, tag, author and date archives, secondary queries such as the Latest Posts block and Recent Posts widget, previous/next post links, wp_get_archives(), canonical redirects and 404 embed requests, XML-RPC getPingbacks, REST routes that take a 'post' parameter, and result counts. This makes it possible for unauthenticated attackers to view the titles and content of pages and posts that are restricted to logged-in users or to specific roles.
References
- https://wpsec.com/vuln/WPSEC-2026-1991/
- https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.2/
- https://wordpress.org/plugins/page-and-post-restriction/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS