# Page and Post Restriction <= 1.6.1 - Unauthenticated Sensitive Information Exposure via Restricted Post Listings

- **ID:** WPSEC-2026-1991
- **Plugin:** Page and Post Restriction (`page-and-post-restriction`), https://wordpress.org/plugins/page-and-post-restriction/
- **Affected versions:** all versions before 1.6.2
- **Fixed in:** 1.6.2 (Update to 1.6.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/page-and-post-restriction
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1991/

## Description

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via post listings in all versions up to, and including, 1.6.1. This is due to the plugin removing restricted pages and posts only from the main search, feed and REST queries. They stayed in the blog home page, the category, tag, author and date archives, secondary queries such as the Latest Posts block and Recent Posts widget, previous/next post links, wp_get_archives(), canonical redirects and 404 embed requests, XML-RPC getPingbacks, REST routes that take a 'post' parameter, and result counts. This makes it possible for unauthenticated attackers to view the titles and content of pages and posts that are restricted to logged-in users or to specific roles.

## References

- https://wpsec.com/vuln/WPSEC-2026-1991/
- https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.2/
- https://wordpress.org/plugins/page-and-post-restriction/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1991/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.