Content Restriction Bypass on Simple Restrict Plugin for WordPress
CVE-2026-15939
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 2 August 2026
Badges
What is CVE-2026-15939?
The Simple Restrict WordPress plugin, prior to version 1.2.9, suffers from an access control vulnerability that allows unauthorized users to bypass content restrictions through the REST API. While the plugin correctly imposes content-restriction checks on the front end, it instead relies on a generic capability check for the REST API. This oversight permits users with contributor-level privileges or higher to view restricted posts and pages that they should not have access to, posing significant risks to sensitive information and user privacy.
Affected Version(s)
Simple Restrict 0 < 1.2.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.