Authentication Bypass in Page and Post Restriction Plugin for WordPress

CVE-2026-118194

What is CVE-2026-118194?

The Page and Post Restriction plugin for WordPress is vulnerable to an authentication bypass issue that allows an unauthenticated attacker to access sensitive REST API responses as if they were a legitimate logged-in user. This vulnerability occurs due to the improper re-authentication mechanism in the papr_restrict_page_post_rest_api() function, which fails to validate REST nonces when processing GET and HEAD requests. As a result, attackers can exploit this flaw by tricking a logged-in user into visiting a malicious page that makes credentialed cross-origin requests, thereby compromising role-restricted content, user profile information, and other private data. Users are advised to update the plugin to mitigate this risk.

References