{
 "id": "WPSEC-2026-1991",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1991/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1991/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1991/index.md",
 "title": "Page and Post Restriction <= 1.6.1 - Unauthenticated Sensitive Information Exposure via Restricted Post Listings",
 "description": "The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via post listings in all versions up to, and including, 1.6.1. This is due to the plugin removing restricted pages and posts only from the main search, feed and REST queries. They stayed in the blog home page, the category, tag, author and date archives, secondary queries such as the Latest Posts block and Recent Posts widget, previous/next post links, wp_get_archives(), canonical redirects and 404 embed requests, XML-RPC getPingbacks, REST routes that take a 'post' parameter, and result counts. This makes it possible for unauthenticated attackers to view the titles and content of pages and posts that are restricted to logged-in users or to specific roles.",
 "plugin": {
  "slug": "page-and-post-restriction",
  "name": "Page and Post Restriction",
  "full_name": "Page and Post Restriction",
  "wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
  "advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.2",
 "remediation": "Update to 1.6.2 or later.",
 "fix_released": "2026-10-29T03:28:38+00:00",
 "published": "2026-10-30T03:40:42+00:00",
 "updated": "2026-10-29T17:44:18.865588+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1991/",
  "https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.2/",
  "https://wordpress.org/plugins/page-and-post-restriction/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}