Sensitive Information Exposure in Page and Post Restriction Plugin for WordPress

CVE-2026-12000

What is CVE-2026-12000?

The Page and Post Restriction plugin for WordPress experiences a vulnerability where sensitive information can be exposed through a misconfiguration in its REST API endpoints. Specifically, if the site is configured with global toggles intended to restrict access, these protections are not enforced properly. This oversight allows unauthenticated attackers to access the full content of published pages and posts, effectively bypassing the security measures that are supposed to restrict visibility based on user access levels. It is crucial for site administrators to update to versions beyond 1.4.0 to mitigate this risk.

References