Page and Post Restriction
page-and-post-restriction · plugin
Known security vulnerabilities for Page and Post Restriction. Find out in seconds which version runs on your site with WP Lens.
3 known vulnerabilities
3 exploitable without logging in · latest Aug 5, 2026
Listed on wordpress.org · latest 1.6.0 · last updated Sep 29, 2026 · 2K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 7.5
CVE-2026-12000unauthenticated≤ 1.4.1
Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
- High 7.5
CVE-2024-11297unauthenticated≤ 1.3.6
Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- Medium 5.3
CVE-2024-0681unauthenticated≤ 1.3.4
Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).